a9d33f1c39cb6d1cb434c277c7b2fd343b6c3a4883e62ee57984e0e7cdf2430a

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe
Size

215KB
MD5

d0ab574fdaf564b09cef76560c8aa91e
SHA1

9fb3756367e1ae01fe934f4b74e6c851df9d1e90
SHA256

a9d33f1c39cb6d1cb434c277c7b2fd343b6c3a4883e62ee57984e0e7cdf2430a
SHA512

f43330f13cab82d4fd65fc96ebaea89c888b2a7f701bfcacd45b0f586a9b6ee9d7f8067f3c37a830c2b4af703b3036f6661030358f61a17669971d3c8a594327
SSDEEP

3072:v2HzvOOfwjdbsCOJHMhVDNY4WaNm5sPrGmKMReGRoutNr6+A3:veOOfkbsNBqtWaNm59oRoS4+0

Score

7^/10

discovery evasion trojan upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/864-0-0x0000000000400000-0x00000000005C5000-memory.dmp	upx
behavioral2/memory/864-15-0x0000000000400000-0x00000000005C5000-memory.dmp	upx
behavioral2/memory/864-17-0x0000000000400000-0x00000000005C5000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
864	d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe
864	d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe
864	d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0ab574fdaf564b09cef76560c8aa91e_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/864-15-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/864-17-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download