66402ca5e3fa2949983446d0400a85796fcbfaebdcc2faf28bfad58447d57680

Analysis

max time kernel
135s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaff02bde134ea724f3ce2d86f2d82ef_JaffaCakes118.exe
Size

1.2MB
MD5

aaff02bde134ea724f3ce2d86f2d82ef
SHA1

8746757b608866fe4cdc4ab1e21e0cb8251b89ba
SHA256

66402ca5e3fa2949983446d0400a85796fcbfaebdcc2faf28bfad58447d57680
SHA512

b0bd9b0d4d4686da0826adac4a715fadeddf9fa16474d9d413669a0e226c573a4519678ca5961f4d57af9d501fa337efd840afa9f64562d5915eaf484c537ba3
SSDEEP

24576:gVC4vdvWIkUF/b5Tm6ZOtk2mjJqjpmg/i0u4CFpLV8CnN85H84au:gVC4vd0UDF0tkRkUui0u4CDLVo+u

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/396-0-0x0000000000400000-0x0000000000780000-memory.dmp	vmprotect
behavioral2/memory/396-1-0x0000000000400000-0x0000000000780000-memory.dmp	vmprotect
behavioral2/memory/396-4-0x0000000000400000-0x0000000000780000-memory.dmp	vmprotect

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaff02bde134ea724f3ce2d86f2d82ef_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
396	aaff02bde134ea724f3ce2d86f2d82ef_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aaff02bde134ea724f3ce2d86f2d82ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aaff02bde134ea724f3ce2d86f2d82ef_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-0-0x0000000000400000-0x0000000000780000-memory.dmp

Filesize
3.5MB

Download
memory/396-1-0x0000000000400000-0x0000000000780000-memory.dmp

Filesize
3.5MB

Download
memory/396-4-0x0000000000400000-0x0000000000780000-memory.dmp

Filesize
3.5MB

Download