639c78d0f88dc9ac25b65348bca153c1556f8f0570b2e025850e335fdf736ec7

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
Size

1.9MB
MD5

cf4ba72f80e005e427a44fac893b704e
SHA1

94e8e805a3bd0610a33161baac471266701e7012
SHA256

639c78d0f88dc9ac25b65348bca153c1556f8f0570b2e025850e335fdf736ec7
SHA512

53de1859130b419b58e4e99d13dc8c3b22fef5e57445b19d97d63e5b5f6a03db1bd62b64e818e2823a2d3c21b84eeee0872a06d4d1a57811bb9e5217bc405ffb
SSDEEP

49152:P8tVzkdYt+6BBE5TNOG1LxcsN/exbpLH5CfizjnsH7NqbBjTvysE5T5t+6U:07zIYQMO0G1Lxd/ephZ9zjnfd3vDO5QN

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000016b85-172.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2484	bringtofront.exe

Loads dropped DLL 51 IoCs

pid	Process
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000016b85-172.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bringtofront.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2484	1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe	33
PID 1912 wrote to memory of 2484	1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe	33
PID 1912 wrote to memory of 2484	1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe	33
PID 1912 wrote to memory of 2484	1912	cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\bringtofront.exe
  C:\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\bringtofront.exe /bringwindowtofront=I Want This
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\I Want ThisInstaller_1725617283.log

Filesize
1KB

MD5
f5b979e554de7eae444efe64a08fb061

SHA1
9b796dee55d81b6df87fa38cb4ab418e17885050

SHA256
1809172cb0f31cbe9ea018b589e8660b20adb05fc1b90f7e66a77311f12cdcf3

SHA512
1c052f3370cc86741917957a964ec687d804ddba06ac682e6b0026884ff5154e7459668dfa9a992e78122af139400d13a2f6fe963da5548136bd997ecc3c4ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\I Want ThisInstaller_1725617283.log

Filesize
1KB

MD5
e74629c56b6a6a0e98fcfbd53cc36971

SHA1
228fbf4bb5b40f57aaafe771c6554514eff27d13

SHA256
86cefb32d86777c96135796a2a79bc4b56c1b293b929db03b23e6bf6e28a40e7

SHA512
f4f753bc5fc8b070a8c230a99c33d90283138b8c4bd20f157b685aab1b709d24f97c61968d6d603e0390861b00b856a620e5cc1e855f548fa25bcfaedabec24e

Download Submit
C:\Users\Admin\AppData\Local\Temp\I Want ThisInstaller_1725617283.log

Filesize
504B

MD5
7d15ef74c077a7f070e3fe10ec33d0be

SHA1
30b6b5e514067c303c9f0db81bfad2fc051487f5

SHA256
23a58212c02931cdc5de0af83fc0b7966960e01ead48eee665956926be70153f

SHA512
e6fe9227dfd18209c6605ba57a47d37491fb605c0cbbba79c1c9ee67cbf2fb7a8524eb0b14bc8f659484fdecb9787c0985d918825210b2c11b856d163b37dc4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\bringtofront.exe

Filesize
328KB

MD5
f29cb80bde4af21c226596e9d125795d

SHA1
72cf17a7e693c90051b84dda540936adceba4c9a

SHA256
899eb66f906f366212d2a09e4949d1701b50ea23c963a6e4f46d287af1573656

SHA512
0397206b5577b9118364918759392733195a2c24d97703430d72739376c5c413ef5be3b4c0f26c9a40f6e946c37d8aa1139ffd8a552b14124774a41ce4909cc6

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\Dialer.dll

Filesize
3KB

MD5
068ba6a2cece65f680895ea627f71e39

SHA1
27070d0fa949a80360426f37b3dfe9eaa0ed66f4

SHA256
ef649d2b3daed72b0778ab6b3f22a02e288fd009cf9e7e76eb1991451e580f82

SHA512
adf99b31790694d8ad02c56b1cb7c9dadeac49d492225a2d297654bfcd617f3afad23990d1d695fba03af1c355456e2e7c3e972eaa9b5ab1770bbb6eef0e733f

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\StdUtils.dll

Filesize
14KB

MD5
21010df9bc37daffcc0b5ae190381d85

SHA1
a8ba022aafc1233894db29e40e569dfc8b280eb9

SHA256
0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

SHA512
95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\inetc.dll

Filesize
20KB

MD5
4c01fdfd2b57b32046b3b3635a4f4df8

SHA1
e0af8e418cbe2b2783b5de93279a3b5dcb73490e

SHA256
b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014

SHA512
cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\md5dll.dll

Filesize
6KB

MD5
0745ff646f5af1f1cdd784c06f40fce9

SHA1
bf7eba06020d7154ce4e35f696bec6e6c966287f

SHA256
fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

SHA512
8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\nsislog.dll

Filesize
42KB

MD5
e47100b70748fc790ffe6299cdf7ef2d

SHA1
ad2a9cd5f7c39121926b7c131816e7ba85aeead2

SHA256
271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

SHA512
88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA8BE.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
memory/1912-186-0x0000000000810000-0x0000000000819000-memory.dmp

Filesize
36KB

Download
memory/1912-182-0x0000000000810000-0x0000000000819000-memory.dmp

Filesize
36KB

Download
memory/1912-220-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/1912-14-0x0000000000810000-0x0000000000820000-memory.dmp

Filesize
64KB

Download
memory/1912-286-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1912-292-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download