1abf3d1ce0fc1317d80acd2875677cb9dcf0ddb507c663ff2df1b348bbdf6176

Analysis

max time kernel
140s
max time network
55s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe
Size

435KB
MD5

b3d8cfde116a83a5d1235abdf235a3a3
SHA1

e8e44261cfa3ca70157c7ba97586a5fce86bd3f3
SHA256

1abf3d1ce0fc1317d80acd2875677cb9dcf0ddb507c663ff2df1b348bbdf6176
SHA512

723ab0a844b1c53c44d7e216676861b8a598b314151710c1a439a03105d0b934bbf92b0a15f1b8c187a6cc08f8f448de454c11c28f8c35b7e3c0d4b0ed0b303d
SSDEEP

12288:Ze6VFcVI7RVRs19Ic6RtbmzL8Y01TM02/eBDh0+HJKoSl:ZeeFUkRVq7ytbmv8Yiw02/yDs

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1292-0-0x0000000000400000-0x000000000054B000-memory.dmp	upx
behavioral1/memory/1292-22-0x0000000000400000-0x000000000054B000-memory.dmp	upx
behavioral1/memory/1292-27-0x0000000000400000-0x000000000054B000-memory.dmp	upx
behavioral1/memory/1292-28-0x0000000000400000-0x000000000054B000-memory.dmp	upx
behavioral1/memory/1292-29-0x0000000000400000-0x000000000054B000-memory.dmp	upx
behavioral1/memory/1292-30-0x0000000000400000-0x000000000054B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1292	b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe
1292	b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b3d8cfde116a83a5d1235abdf235a3a3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\se.html

Filesize
224B

MD5
82e744e7ee51f737fad224728e525674

SHA1
c2eb87b98c514921e99b1b48dd3bae688711e87b

SHA256
097f6d9019a10662ee19e64e28e572e26fd27acedd0bd09843d67cebd76b33ce

SHA512
54d01f2e267819f5b31fe4269015b1bbfabce7d0205181fdccf9ac81e38b649aa73d4f06806a47376a34ff617ab9642035d6c73192e7a55b6283ae1926b206eb

Download Submit
memory/1292-0-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1292-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1292-22-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1292-24-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1292-27-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1292-28-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1292-29-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1292-30-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download