19fc974bdb44320746ac108a840fae635698d31938b164073d91bbafeac00949

Analysis

max time kernel
136s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
Size

51KB
MD5

bab06d1595599bc4a04959804a743bab
SHA1

85fa5750aa5dac48fd27462cc05e369b2708d657
SHA256

19fc974bdb44320746ac108a840fae635698d31938b164073d91bbafeac00949
SHA512

94bb6bc33a3937c84a2fedf6f1db6d55e10302e5186c9d1d56d5304f2f0b3db4fb055d6d4dc7ed04ed7c2646877251b2244635f1a68c983280d359c32a5e8a25
SSDEEP

384:ZXPXaQ90vj9k7VDGLl4Twf6mQNll9y/4:ZPaQ2vJk7VyLlYwimQzW/

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00070000000233dc-7.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1080	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
3472	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
1080	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3472-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x00070000000233dc-7.dat	upx
behavioral2/memory/1080-9-0x0000000010000000-0x0000000010009000-memory.dmp	upx
behavioral2/memory/3472-11-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dazz.dat	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\qrd.dll	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\4422404.ime	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1080	rundll32.exe
1080	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 1080	3472	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	88
PID 3472 wrote to memory of 1080	3472	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	88
PID 3472 wrote to memory of 1080	3472	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" 4422404.ime,myInitIme C:\Users\Admin\AppData\Local\Temp\bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\4422404.ime

Filesize
7KB

MD5
0047b041b1e538eac863fdfee4ab64f9

SHA1
f43d882ee69c25f4d7212a9c780c1a04c9a0ba4a

SHA256
57022d4627cd05d7073d1cc4ce78767a2d7331e58742b7edd92ab37027353c93

SHA512
55fb9eb1fe03ea345d7e9b8877a5f3ff584da5addb4fef0f8b5b8ff8990faf1f2ef5fb238865b5123e131d8786ec85f840ded370a56c69b53ace349fdcff4ec5

Download Submit
C:\Windows\SysWOW64\qrd.dll

Filesize
7KB

MD5
9e3117b68c03262e10eb7f283e1a860e

SHA1
2f558d6ebabfdf8cefa4b7ce66c0a269fdd8c706

SHA256
190207a6edfa3930de871c8e6e5a0fdf531542ffd037d63ff5626d773a61a15c

SHA512
5cb02b03a58a4a07e1da2e4b1597803b28ac2c9e8c6f9f8b5a65989660d99504f63a0b128feb4c6bbc5dea1643456a02538d5a0616bd95c7b99f753f9cf16f93

Download Submit
memory/1080-9-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/3472-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3472-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download