a1ae45411b7992f9ec59d5e381fb0d87a9acbf06c7ae5e323255778377f13241

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe
Size

4.3MB
MD5

d2d532eeddac4d19e952b364bc0b6909
SHA1

b899b062d94aeee5a88f3453bbd78647060c6855
SHA256

a1ae45411b7992f9ec59d5e381fb0d87a9acbf06c7ae5e323255778377f13241
SHA512

e6a4a6263951bc021b6d72cc0074e3f5a94dff8e977bb12f39eaf09e406accc37c0e72d779463c8705f41ec25cc5b99743ab0785bc9bb82a5e4ceb107bdf0f18
SSDEEP

98304:udI8FSmHFa7+/zqitNiN09x90NVFNI9+625G5XxKlfo:EjxzLNeIx9MFNIs625G5XCfo

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000f000000023379-10.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
1184	d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe
1184	d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1184-0-0x0000000000400000-0x000000000055D000-memory.dmp	upx
behavioral2/files/0x000f000000023379-10.dat	upx
behavioral2/memory/1184-16-0x00000000051D0000-0x000000000522B000-memory.dmp	upx
behavioral2/memory/1184-15-0x00000000051D0000-0x000000000522B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1184	d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe
1184	d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe
1184	d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2d532eeddac4d19e952b364bc0b6909_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{015527E1-9D5D-41BA-9EBA-DCF509F1CD32}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\css\style.css

Filesize
2KB

MD5
bf7569fd66b7a398330ab7c1c31965a4

SHA1
efebe9b76fa49deda68efebfaed68f8b4880051f

SHA256
e34727af72f99606ffba57b2cacbcfb101e17fac2f86462d4bde8ff66024eba7

SHA512
2266db6fbbe0ae92c87332e13157114c5f2a72265b74e333bed6ae884346bdb1194b40c0fa127c05ad9287a2b5b80e864ab809b72f971abe02eb510ed2715f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\images\bg_bottom.jpg

Filesize
351B

MD5
f76e35ee80fcd4052ec4e4106a13f2d7

SHA1
1ccb169d78851733e3a384828c06021e1fdd279a

SHA256
a386a4e102b734e6085daa926d3a3950fcbe3c1631018d693095c17e86952a30

SHA512
ce6fc685581e784d1adcd8168c245bfcfe5868657be94c45459c533e318393123245d3a1eac9f6926bc0006dc520848ba6ce00e6a08889e3dd502c706fb1cb3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\images\btn_install.jpg

Filesize
3KB

MD5
de97d4ffab1f89b692e05ae961aa2535

SHA1
7d44832261c41732db3522633c29a3abe9e0f662

SHA256
2eb33619ce06d76dd65e5b0196825ae11e089745af9549455cbe0a0c0356b117

SHA512
8f62c62d779bfd8184e21ca4ac533f6619d19c478333e6172015a7413df4743129ee17fad56390ce2e9dd1bdb1f41dd1af181cd43f8ad28e87abb0e8f76395dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\images\btn_quit.jpg

Filesize
2KB

MD5
a47dc0b965f9c5a12645a7cdce093963

SHA1
05efd59dcfd9bb580a2c2a10ffb83a1c7c0f0cbc

SHA256
f62f2bc6e542ec755f182d257c80d3b14d5c968ae52a2062239daf80445d3b42

SHA512
66867c0c94c2d651eace3fdbb498a86f68163502d70a0bb72ba3554de48818e60634471f6778e35dfbf7a5563d89b02eeeb93731557ee82949324da3df266d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\images\index.jpg

Filesize
19KB

MD5
53a64792cf0cf4184e6f925888a3fe4b

SHA1
3a242b9abf7c5d7722d0db3f864d1e58089577e3

SHA256
786d13444e1f52f3263ff9ace9e28b1dd4e5b897ab153f9bfec13050f87389fd

SHA512
e0d1fa6d50d4da2d780948e08eae474de9ae72ed54fb2554d0b6e50152f92be822fa500972ac56091631b445caa542ff927de36ef23edc203597e18dfe9ff3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\images\text1.jpg

Filesize
12KB

MD5
9a58c8baf22f4a76e6b119100a6e51f2

SHA1
1f86835339b552a3b6e67a15b2cfb9ab75037364

SHA256
b37196ce78804826cec7c75b398a9f434979cf3426c12de26c3210d4b89173e1

SHA512
6348e4bab6a92ad928253772171871592ca458bcb3d65beb82f64e8fbbf07d4e7d7a0fb1c86097dc182303a8055e17f3745d162536becd0c55cbf56363122bd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\images\text2.jpg

Filesize
4KB

MD5
1965a6e2723f1370a3291a758d22701d

SHA1
59149b9630986114f82937cb92c3298cc52fe024

SHA256
9c33cc36d582d12421298180b6acf3856ee59485d4567c2fbd4c77bebec564d2

SHA512
f38decc62a42c6e53e05b95d8d82511ab82a802a7f93cd8a4b5f6dde28f8e310844276ff142e4096aaad4e7228b769cb90b988d30167b76cef5cc0e94650b067

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{6185624B-6DD9-4AF4-BF7B-DBE0C249E283}\page.html

Filesize
1KB

MD5
f53c74115af3730f902ee47a7639a53c

SHA1
166820ff9ff7d5383a06f001a9c1ff3b400b9f93

SHA256
ccafdd53d3af9fa1bb36a654b6992571d4c3899892f3353e6bfb2a8e3fa4cdc5

SHA512
b83b91721411b43eedc78e05f0ed9b98aa2f55c2ef6bd4067c6bf5839567eeba0af82560e8886b44bb80e3e23c067beb0e196ca12707f6324492874ed1f88160

Download Submit
memory/1184-15-0x00000000051D0000-0x000000000522B000-memory.dmp

Filesize
364KB

Download
memory/1184-6-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/1184-1-0x0000000000B30000-0x0000000000B35000-memory.dmp

Filesize
20KB

Download
memory/1184-74-0x00000000051D0000-0x000000000522B000-memory.dmp

Filesize
364KB

Download
memory/1184-0-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/1184-2-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/1184-70-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/1184-71-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/1184-72-0x00000000051D0000-0x000000000522B000-memory.dmp

Filesize
364KB

Download
memory/1184-16-0x00000000051D0000-0x000000000522B000-memory.dmp

Filesize
364KB

Download