561d4613ca92a9edb2d32fe82e94ff75b6da47b9b0ad2194936dd3e31ecf2433

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe
Size

89KB
MD5

d5c0a4e62f301930de6d9e058697909d
SHA1

f584822328e1422d7424c1ad5024190680392b9d
SHA256

561d4613ca92a9edb2d32fe82e94ff75b6da47b9b0ad2194936dd3e31ecf2433
SHA512

76ffaac7074431425b6bf87f083cf798fa5a7e2f3e76468999de38f45c878632da67b5a6dd66b29300070a37cbc7f48359828a6a8a2ecec233be7a7b96761c9d
SSDEEP

1536:Y8IO5kEDIUtKVr/99+1UR1d397lA4hzVsN1EVLldBPEMUP/txravehUKNBZxJ/p:Y8b2UtK9998ey4W1cdhGtxrseasJ

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2312	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2632-0-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2632-13-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\AutoUpData.exe	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe
File opened for modification	C:\Windows\AutoUpData.exe	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe
File opened for modification	C:\Windows\AutoUpMain.DLL	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe
File created	C:\Windows\AutoUpData.DLL	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe
File created	C:\Windows\AutoUpMain.DLL	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2632	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1200	2632	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe	21
PID 2632 wrote to memory of 2312	2632	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe	31
PID 2632 wrote to memory of 2312	2632	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe	31
PID 2632 wrote to memory of 2312	2632	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe	31
PID 2632 wrote to memory of 2312	2632	d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d5c0a4e62f301930de6d9e058697909d_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Delete.bat
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Delete.bat

Filesize
218B

MD5
e5b6a63beee0efabdc914b9197b81853

SHA1
35643c0fadef42b71d1889a1a86c63cb7647b170

SHA256
e0d919d1880540d57fb87989775822f818ed28e0e7af7ef3e7beb67cf1673021

SHA512
80ca58b1e0193a7056601ed8bb9cba46c78989efa6077be99fd8bb17e937b04cd5a55af1fa4567c180554bb86a5ac193127824a0f402642398db8533a4b5a21f

Download Submit
memory/1200-4-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2632-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2632-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download