315800dd3da52118c4dda859d1f51fa6daffacc1b3a34a248d6ad572b4e5f3db

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe
Size

1.3MB
MD5

a7b3a7d85d5d90bdfaba89e493e9ed70
SHA1

265ad1041d028cdc2f0f62850b8cd03ba06a187b
SHA256

315800dd3da52118c4dda859d1f51fa6daffacc1b3a34a248d6ad572b4e5f3db
SHA512

3e368a549c6accfd37606cedad5a91a4890692a9619e879a6c8c19ad402858880460f6ecae4482ed0918b73c8ab3f4caa25ab495dc35095cd90690f9e88c1336
SSDEEP

24576:TiUf55Z79DAYNcxLY92NVupEzn7f5KaoRQev8ktE8OorTt2Bc7YE+:+Uf/DfNCw+Mi7fMRQRkt1MBN

Score

7^/10

discovery themida

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2728	WinRoot32.exe

Loads dropped DLL 2 IoCs

pid	Process
2732	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe
2732	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2732-37-0x0000000000400000-0x000000000053B000-memory.dmp	themida

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WinRoot32.exe	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	WinRoot32.exe
2728	WinRoot32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2728	2732	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2728	2732	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2728	2732	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2728	2732	a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe	30
PID 2728 wrote to memory of 1200	2728	WinRoot32.exe	21
PID 2728 wrote to memory of 1200	2728	WinRoot32.exe	21
PID 2728 wrote to memory of 1200	2728	WinRoot32.exe	21
PID 2728 wrote to memory of 1200	2728	WinRoot32.exe	21
PID 2728 wrote to memory of 1200	2728	WinRoot32.exe	21
PID 2728 wrote to memory of 1200	2728	WinRoot32.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a7b3a7d85d5d90bdfaba89e493e9ed70_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\WinRoot32.exe
    C:\Windows\system32\WinRoot32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\WinRoot32.exe

Filesize
50KB

MD5
51ee58b967257e1ecb2f5f9d00cf9e6b

SHA1
305b93df39c946eb1104958cb6a2e0c2ecd9d1d9

SHA256
dfe162da11dd63bc51b48e99450850dfcd450663679a26848e908348806cb2fc

SHA512
f7a604b7f5fc1de87bf9819d73a4eaff63bc544f4f93683a3834a2b5728e9c1fa35ccc3e0eb2fc313b99db10f583741d60a45e7993e86e7f1de5f62aa0453a3c

Download Submit
memory/1200-19-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1200-26-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2728-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2732-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2732-1-0x0000000001CE0000-0x0000000001DE9000-memory.dmp

Filesize
1.0MB

Download
memory/2732-2-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2732-9-0x00000000040A0000-0x00000000040A9000-memory.dmp

Filesize
36KB

Download
memory/2732-38-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2732-37-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download