26c1be89d57990bb7a2782e954fe321513ee4256fe6eb41345cf5a5a032be9e3

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2c1daf643c3c0e36bdf6a490e1eabbe_JaffaCakes118.exe
Size

164KB
MD5

b2c1daf643c3c0e36bdf6a490e1eabbe
SHA1

8c2544243621c7ad7cc9e3bd0a1a3572b63d318b
SHA256

26c1be89d57990bb7a2782e954fe321513ee4256fe6eb41345cf5a5a032be9e3
SHA512

b5991a21acc2bb6a9d6fb11d73d1cf53cc2ca919377ba39b33ee39b4763fb63c6e735655347d0845e1b973d2f6cf15544cd3a33c764904856e34c1aa8c602fb6
SSDEEP

3072:zK5Idcr8l8MVmHkinJgRUTHDW0szRJtArjRmx0MUVrxlVo9UQUyd/XK2vG5:qIDn9YJzW0sdH08uMUVV0/6QG

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1484	b2c1daf643c3c0e36bdf6a490e1eabbe_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1484-0-0x0000000000400000-0x000000000049B000-memory.dmp	upx
behavioral2/memory/1484-7-0x0000000000400000-0x000000000049B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2c1daf643c3c0e36bdf6a490e1eabbe_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b2c1daf643c3c0e36bdf6a490e1eabbe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2c1daf643c3c0e36bdf6a490e1eabbe_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mjcqnv.dll

Filesize
453KB

MD5
94b03aa58b009cd3e52a3abd8caf01f3

SHA1
f246254076a673a0ce0ddf8acfce7a39664f5172

SHA256
c1f1bcad9c8be0cdb257609cb9e69856075526521f78e451f838fdd3517022cf

SHA512
f441717e7f10376feb486dfb75424c35aa7547b84f15c76ce84fbf963d4c34c830142b2d456a80dd4a78786a42b639d79703d192a25e7714eb766a134676976c

Download Submit
memory/1484-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1484-7-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download