e1434aca60ad57a4c978511638d026b87e443ff08646e423a28f5fda3ae948b9

Analysis

max time kernel
140s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe
Size

452KB
MD5

da63b4b2a949f849dd77ee29fc9373e7
SHA1

5e208a1f45d17f5beaa8a278bd378abcb5ae2db5
SHA256

e1434aca60ad57a4c978511638d026b87e443ff08646e423a28f5fda3ae948b9
SHA512

3585c44f903aafa742bba7cf79aa5a89b250675b46d4a8da174ed6d8047a568f4bcb4d38c4519e72510c1c4dcf16bb4210e2e90cf9d679f24857866a92f2121b
SSDEEP

12288:l0iGJV4QpTjFhT981hOC+qAbKj5e3FmxcIdXGuwwYeAmpU9K:+i/QZ9sOC+qsKp/dMPeAU

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2348-0-0x0000000000400000-0x000000000062D000-memory.dmp	upx
behavioral2/memory/2348-12-0x0000000000400000-0x000000000062D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2348	da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe
2348	da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe
2348	da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe
2348	da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da63b4b2a949f849dd77ee29fc9373e7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2348-12-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download