c45285e9375f8bb429b0e76c2f8e63e9ddbc4b345559e434d55010ea33af56a5

Analysis

max time kernel
141s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe
Size

88KB
MD5

a7f23a7c8a959babf90d9ce741296f9d
SHA1

619577fd5e4753a7ae47dd8364440fa3291efce4
SHA256

c45285e9375f8bb429b0e76c2f8e63e9ddbc4b345559e434d55010ea33af56a5
SHA512

9f7d92b3bc927d217908dbd7ecb751235d5baa26ca360e2b160893cbb0a19b295aae433d431f8ed955f7eb433d115f7449b846f8c9cc4aec7074320dc109bdd4
SSDEEP

1536:blE2WXd8m8U3UYVsvwwwA1kHWa8kUAZT2jNW+dlrVpurAB5QXTXlGX:38d8mBMwwh1QakJZiBBdtVsrA4D0

Score

7^/10

discovery

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000016d7c-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1316	a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s32kcp.dll	a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\vknt.cfg	a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe
File created	C:\Windows\vknt.tmp	a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1316	a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe
1316	a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7f23a7c8a959babf90d9ce741296f9d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\s32kcp.dll

Filesize
22KB

MD5
2a49b50ef5d7b0add47f7318de5655cb

SHA1
88824905ecdbee1d1b104d84098e6d31b5441ffb

SHA256
daa77961614405b008b427263fe46c8db004e3cf637659aa94b2325332d207e9

SHA512
19ec41d781b269fa1e724e01f9ca6ba6fb63a8c93f313f1b688ede2eddae8b5dedd38d63451ddff05c448e845e0e2fe863b2a55276d12b6520406ea8760ae031

Download Submit
memory/1316-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1316-6-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1316-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1316-11-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download