6b483d45dbc00e86f0b23776b377d7e1a9c4dbc4a9b7885f9112a17daaab62ff

Analysis

max time kernel
103s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe
Size

193KB
MD5

d0f2d2a971c24dcf52f207ae0bd66634
SHA1

92879376e0d19c033bac5633b3d20a4993bcaa96
SHA256

6b483d45dbc00e86f0b23776b377d7e1a9c4dbc4a9b7885f9112a17daaab62ff
SHA512

3c06b1720ee88d40622cb190f4d80a97b1fbb788ff132194cd897ce5d98ed0185627c54fc610992521be0ea613eb263e7860b5f32321665452062f62779d9343
SSDEEP

3072:82LAYuJoPt+w2HWHVATMiFIpQXr6t5McaZgz2DDZ0W:CJoPBN1ATqWrkjT2WW

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2908-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2908-16-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\IESettingSync	d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2908	d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe
2908	d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0f2d2a971c24dcf52f207ae0bd66634_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\disclaim.html

Filesize
19KB

MD5
4407ba6a64eb8214288a301ccdb63021

SHA1
a72537c0095fb40938b6843ef8ce31c743a9978b

SHA256
c8e9940e1916bb8367e67857e9acefadc24640018cb45f2002281ba472143012

SHA512
c0b7488f22a89d1f5371f346d0b4b12dddef85998774923075b7d86eb2fc14173d341253464cba386ba98a9dba4c440d49ce3e520233e771fe42eb80c29d1348

Download Submit
C:\Users\Admin\AppData\Local\Temp\index.html

Filesize
18KB

MD5
81c78bc0b45bdf5c30e418b6b237def0

SHA1
f12c7a322267ed9d6973faa554411fc104b3b0d6

SHA256
d22448ed09bf4ecc7a44858396f303cf492d474da1f908e1cb1b3b7a3c8532b5

SHA512
8f51d16dda87843c55bfd8db307afc556f71ab1e086f67c005212b874d73883168606588c40c4f0221bf3731014cd022d4fde1793dab651afc131b2c8712e02e

Download Submit
memory/2908-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2908-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download