01e891b98ef98936c000c8e9b68e152b3a717e418a5c4969bcfec5df0c858541

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe
Size

619KB
MD5

d51f05a648165623202fa110ff936dc7
SHA1

512140e850ef658528c611bf8e706dad09341a8a
SHA256

01e891b98ef98936c000c8e9b68e152b3a717e418a5c4969bcfec5df0c858541
SHA512

218e42a28cf16dfaf50db2e5deaca920bee85d532bba62a821fe3e6a5dd793d6d86fff84afa8b428b1267149a37d1f2a50f8d5feafcce45c51c19fcdd8f1220c
SSDEEP

12288:ZJEgaHuuc3YZKm99NrYUHAOtf+egWEuimfULKQxLQLh7JBqGTAPLpUP:TN3YZKW9x1Hd2egWEmoKQtQPBJEPLGP

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	AsClient.exe

Loads dropped DLL 3 IoCs

pid	Process
2756	d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe
2756	d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe
2844	AsClient.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2756-0-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/memory/2756-31-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsClient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	AsClient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	AsClient.exe
2844	AsClient.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2844	2756	d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2844	2756	d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2844	2756	d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2844	2756	d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d51f05a648165623202fa110ff936dc7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\HysrRCTL\AsClient.exe
  "C:\HysrRCTL\AsClient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\HysrRCTL\AsClient.exe

Filesize
399KB

MD5
c3a286a1e03c8bfa1cc2d736aefac3c4

SHA1
a40a44947a8c76ca6e357bbcef1e43aa264ef068

SHA256
d74a8b24e0e31016463c20f036f512d48e617bcbda088a7bfdd377b24bd406c4

SHA512
321fa01a7112dacdcf77e7c83dfbfd08dfdfafd309f0542aeee8c6cc80e2e77f75a5dae962c66d8d24d13efe9638419ba7e44c5e1b09a552019a86c998180b52

Download Submit
memory/2756-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2756-31-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2844-27-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2844-33-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2844-34-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download