1b31a039328236a49b052a6acc4176a60972da82b2380c7b75831159e3f98347

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
Size

26KB
MD5

a4dbaee7085faa32e2ccbc56efb386ab
SHA1

e9e78890d0ecb50857f058ee4c985d1ba72e21b1
SHA256

1b31a039328236a49b052a6acc4176a60972da82b2380c7b75831159e3f98347
SHA512

76b0a26bc86f16643a336f383ef38ab4c048df6ee0bdbfdecd65c65d74760763914e54e7a1d729c17583b14315e919408cc936cd6cada27e2c364cf4a15a7423
SSDEEP

768:RLASB/8bAealqy2w7ONQBSm2aJa7TrVkN0ZL37:JA9bdLQO76N0ZL37

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1832-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1832-9-0x0000000000400000-0x0000000000417000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack\DefaultIcon	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1832	a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4dbaee7085faa32e2ccbc56efb386ab_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CPWGameRecord.dll

Filesize
35KB

MD5
e2dba9fb8ac7f1201eb4bc6b2f8576be

SHA1
afd105be946bc20323fcbf296ad166299d039e31

SHA256
3c5b0356d1fe01dbfe6313a6adac368897af08f6a5e69f4e6ebf5ba237ba1aab

SHA512
cf22a7ace8e5b712ae0aa785d66ed9b46c34135eac22ef6c69915fda2edcd36f6c36c7c864ca17ced50a4cbc6c839ad4d5fce8f4688a04b7513b071f3fce2e9b

Download Submit
memory/1832-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1832-6-0x00000000005C0000-0x00000000005D3000-memory.dmp

Filesize
76KB

Download
memory/1832-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1832-10-0x00000000005C0000-0x00000000005D3000-memory.dmp

Filesize
76KB

Download