ced6143085ee90e364878120d5d314349838f99bb5e5cbce509c8cffc0ec4fcd

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3dc7bddccba42692c4cf8e5cfc6fb0f_JaffaCakes118.exe
Size

225KB
MD5

d3dc7bddccba42692c4cf8e5cfc6fb0f
SHA1

507b2ebc1729f7b255cccf4c6319e5a4723f5943
SHA256

ced6143085ee90e364878120d5d314349838f99bb5e5cbce509c8cffc0ec4fcd
SHA512

1de54e04bbf3a048c38420d2b7864a3b9b8a12eb09fd9bfad6ab206c4f6143c49dcb94e5e33d22eae01e284b07e79dbd9127d26cdf38cad253209084d4175ea2
SSDEEP

3072:LuDJTouvYCuuk0B0wqRKpJVivx1utX4fJDhq6mtHCcAA4AnK7LPdlu3jzFWsRWye:ch2uFB9o2X4fJDhnmAA4jPGTRRNe

Score

9^/10

discovery upx

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4572-1-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4572-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4572-1-0x0000000000400000-0x000000000041A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3dc7bddccba42692c4cf8e5cfc6fb0f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	d3dc7bddccba42692c4cf8e5cfc6fb0f_JaffaCakes118.exe
Token: SeRestorePrivilege	4572	d3dc7bddccba42692c4cf8e5cfc6fb0f_JaffaCakes118.exe
Token: SeBackupPrivilege	4572	d3dc7bddccba42692c4cf8e5cfc6fb0f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d3dc7bddccba42692c4cf8e5cfc6fb0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3dc7bddccba42692c4cf8e5cfc6fb0f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4304,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
1⤵
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4572-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4572-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download