816a3178a2290c1adb65b642d96c261f5c8c873613754b6857455e1f133b465c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9525db8ccc4d94fd83de0d0538c6c40_JaffaCakes118.dll
Size

42KB
MD5

c9525db8ccc4d94fd83de0d0538c6c40
SHA1

74524bd7496288ab4ff5b894cf391161627c3679
SHA256

816a3178a2290c1adb65b642d96c261f5c8c873613754b6857455e1f133b465c
SHA512

b353df529027872ac84b0e310b168ec2a055adfb5c28b93690bd229de7846962a0d321a8955d814a1bd334dd32340d2bea289d9e83899eb1a49b7f6bc8d4eb83
SSDEEP

768:GwEhqQSo4xK/3UxRKceqt5rWb0rlTKyUpuFYCK2+da:0uokK/3US4HrWb0pUX

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x0000000020000000-0x0000000020022000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2168	1900	regsvr32.exe	30
PID 1900 wrote to memory of 2168	1900	regsvr32.exe	30
PID 1900 wrote to memory of 2168	1900	regsvr32.exe	30
PID 1900 wrote to memory of 2168	1900	regsvr32.exe	30
PID 1900 wrote to memory of 2168	1900	regsvr32.exe	30
PID 1900 wrote to memory of 2168	1900	regsvr32.exe	30
PID 1900 wrote to memory of 2168	1900	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c9525db8ccc4d94fd83de0d0538c6c40_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c9525db8ccc4d94fd83de0d0538c6c40_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000020000000-0x0000000020022000-memory.dmp

Filesize
136KB

Download