b0bcdaa1993fafdf8b007bf678981c09c14732c04be1f2108605755d5ad1168f

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bea94016d5864b8b17869227a503de95_JaffaCakes118.exe
Size

103KB
MD5

bea94016d5864b8b17869227a503de95
SHA1

7fb4bd4345d4a1cb5eb5d4dce17a2d14b90d2045
SHA256

b0bcdaa1993fafdf8b007bf678981c09c14732c04be1f2108605755d5ad1168f
SHA512

eae860bafe76db3e013ef2f0d97b10ef0405fce39e2db3dc9bf64431d2b6995f38094479b59277b50ce4f064a8f93b0ff5ddfb886b5745032864d10e623f1db7
SSDEEP

3072:IgXdZt9P6D3XJbCtKE3TyUxw+RZ8iGWrsYt:Ie344t33C+RZCE

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000b0000000234be-2.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4156	rundll32.exe
4156	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b0000000234be-2.dat	upx
behavioral2/memory/4156-5-0x0000000000A40000-0x0000000000A60000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
876	4156	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bea94016d5864b8b17869227a503de95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4156	4748	bea94016d5864b8b17869227a503de95_JaffaCakes118.exe	84
PID 4748 wrote to memory of 4156	4748	bea94016d5864b8b17869227a503de95_JaffaCakes118.exe	84
PID 4748 wrote to memory of 4156	4748	bea94016d5864b8b17869227a503de95_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\bea94016d5864b8b17869227a503de95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bea94016d5864b8b17869227a503de95_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8oRABFr1.dll",Install C:\Users\Admin\AppData\Local\Temp\8oRABFr1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 600
    3⤵
    - Program crash
    PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4156 -ip 4156
1⤵
PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8oRABFr1.dll

Filesize
72KB

MD5
da1c7313cf151c793c4b0156ea75ba8e

SHA1
ffa36f8a21183fdb5840c18aaac40251d02a4b34

SHA256
17baf6a5a87009edaf25326892ac2f18c72955bce475349d85c2620237090cc6

SHA512
c2fc222c989e0822839e1dcf6a2d099a9d42fc6bdbc39577ec1bb4c43afc426cbdb322b0e59e1c963f66a3da8071c93ed0609969408d82bbd0a144614928d174

Download Submit
memory/4156-5-0x0000000000A40000-0x0000000000A60000-memory.dmp

Filesize
128KB

Download
memory/4156-6-0x0000000000A60000-0x0000000000A62000-memory.dmp

Filesize
8KB

Download