19d095b7eab02a28022008c21e3b4ec73ea9c0a1352f8f03bd17879337643e17

Analysis

max time kernel
144s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
Size

359KB
MD5

b926f0dc12ba522f0794adf9aac327c3
SHA1

78c7d7e5186387fbd1150cdd45559d96e1677724
SHA256

19d095b7eab02a28022008c21e3b4ec73ea9c0a1352f8f03bd17879337643e17
SHA512

5fab6df3ed010b1c8b2f22f0ed9e9fb05aab5d467197bfc1693f0c56346115d4ad2da4d91adf15ebe0fdfd50816387b29ee98a740476d48afed1a11349df330f
SSDEEP

6144:ZgRyiIWQFpUv4/B+FrM144XlzKlUAzYYbuewX79GtPuB8PxwPh79i5s/CoS9iP6N:3iMCv45+uK4VKXknewr9GBY85wPTi5sG

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3196-0-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3196-16-0x0000000000400000-0x000000000050D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\IESettingSync	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3196	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
3196	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
3196	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
3196	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
3196	b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.data

Filesize
795B

MD5
a08f6e024f1d317492ac8df64c25f11b

SHA1
49051d202b8ebba720b618697bcb2f7f58dcb5f9

SHA256
abeffc76b9fe455ec0f291cd577eeef3d32cac1fe7d74d89362291c58c9fc2ce

SHA512
6950ae4b2d600e7b9b522de873e0558d81b436d2bd9897c4b3293d1ec2b1f1d3c2940267e7a9520623d8d5d4dde0949fc3dab7a8b25687b7c02b60cd230b9877

Download Submit
C:\Users\Admin\AppData\Roaming\GetRightToGo\b926f0dc12ba522f0794adf9aac327c3_JaffaCakes118.htm

Filesize
635B

MD5
33f09577707d079a40f706a18e126d92

SHA1
0cef1f55b72a84e584a51e79a6787ea78d74a603

SHA256
e7f6bd122fcb829793f4047a5b929668b0a91ebfe31247b479586ec6d8f2b378

SHA512
5538c5b4e538a97796bfc412b3a81449931a9bbc1fa4e69500a0b30b35c1259bda857f392d85d87893999098bc88a432f28d2f699fadc295709a75b8113933cb

Download Submit
memory/3196-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3196-16-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download