531f96de7d5ffd52f3bf32c6944659f801d285393af5b7e30d8dfbee779807e1

Analysis

max time kernel
140s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
Size

2.0MB
MD5

b2e10cde5b4904700db3a48a975b9347
SHA1

e24ea54b140884cf8b7086eac3ab66637ab07636
SHA256

531f96de7d5ffd52f3bf32c6944659f801d285393af5b7e30d8dfbee779807e1
SHA512

b802b52a0a208681ebbe58a92ece071a705837aeaf1fa9be08b298048132f5b4c322fd5097b6867dd8d5fb8f11d73a524b5c52149deae540fd789ee6e751eec2
SSDEEP

49152:V6ajuti/oTr5foomrh0rCyESs33bzHO19uQ:V6Szo/RKrKrCyw3LzvQ

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023591-12.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
856	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
856	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/856-0-0x0000000000400000-0x00000000005A5000-memory.dmp	upx
behavioral2/files/0x0007000000023591-12.dat	upx
behavioral2/memory/856-30-0x0000000004FA0000-0x0000000004FFB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
856	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
856	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
856	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4256,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:8
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{F68E56C2-0E0D-4722-84B9-12A19AE095C4}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{5F8E8CDA-45CB-41A5-BBFF-B6FC4328BFCD}\css\style.css

Filesize
2KB

MD5
7757619b8df51d677c79395a84e0c539

SHA1
8fa1685f830da61a0f4bbdb1db428f4dbef9c971

SHA256
7c8000bdae47f22b1db799db5e583902737de0fe37bf2581b18bedb63155b1a3

SHA512
3b779b7e4694bf11600b802ea690871f7e65f880c56b5b76fbb0ceede64feee143f6d23031dc485510cb496dad89705999f2e66d4df2390ca318570ff6c7d731

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{5F8E8CDA-45CB-41A5-BBFF-B6FC4328BFCD}\images\cellar_bg.jpg

Filesize
548B

MD5
4777779f71fde6d16f6cc99013c8daff

SHA1
312f97b25bd743a8a8d2268bdfd1ac53701345c2

SHA256
46e860286f1f016711f9e6a8b36335ba549c58aadd67322dae897c0f83c06cd2

SHA512
1b4cc3e5613c6bef54b47d23a53315f802a016d5961b81b4eab4012c8da1045fae3af486c97e281f9829d83f9190af29e685be2b3bf3ebc89cbbf0d4fcf5e775

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{5F8E8CDA-45CB-41A5-BBFF-B6FC4328BFCD}\images\index_top.jpg

Filesize
26KB

MD5
05c3582a4efb14334262dec9320b8ac3

SHA1
0c6d42c0f417c05ae285327b49002474021e4703

SHA256
48f5f24c3b2b24c244cf7211dd9804557436d6e617d9891e308934f32c2301c1

SHA512
f4532bf0d0676f64dd114139a86049c093c61c3926a929a2652d7f7d724dcb7505c03bbac3687c7a56f313359d5022137ffa25035d69cf2f91a745f867a124d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{5F8E8CDA-45CB-41A5-BBFF-B6FC4328BFCD}\page.html

Filesize
1KB

MD5
208bf1089774167723e951ea69f6e60c

SHA1
6749d9193301e617997a0b1db2c5d1441b6477a5

SHA256
e3838c923b1e2f95d8be973d7e149f984bdcd03109648be0a80d1d4ab499e35b

SHA512
d5d42863cc001e2a66ada472e8bac3114a026e1927018f1ecb48e5f21743b4db770360e66522d86c3adb22a73a3e53b7a78e91c47a74135bb35531238d3618e0

Download Submit
memory/856-0-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/856-1-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/856-2-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/856-6-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/856-30-0x0000000004FA0000-0x0000000004FFB000-memory.dmp

Filesize
364KB

Download
memory/856-67-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/856-68-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download