1bf4aa43bc33b2143a43f9b6deb738359367a1297767d496f605be7e8c2f1f98

Analysis

max time kernel
126s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe
Size

651KB
MD5

dd29311c0eec6f861161f45e7961e2d3
SHA1

041cadb471e96e910731e949b453ceaf7e6d7631
SHA256

1bf4aa43bc33b2143a43f9b6deb738359367a1297767d496f605be7e8c2f1f98
SHA512

8de3497c70babf5d2cc4345197d36ce14ab96590297fac5d6b419ca2f5f15478ec5a39c2182be8cfb208b12590cbb845f2b9c0ac9f0bd98238295e1ce5fdccf1
SSDEEP

12288:K7I/asQMNK2de9oiLcsmcQ6RIlReHfLquc+2E59T42IVqe6:K7IZz0oiTmcQ9Ruc+pE2IVqd

Score

8^/10

discovery vmprotect

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\HKNTAPI.sys	dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1936-0-0x0000000000AE0000-0x0000000000C77000-memory.dmp	vmprotect
behavioral2/memory/1936-1-0x0000000000AE0000-0x0000000000C77000-memory.dmp	vmprotect
behavioral2/memory/1936-7-0x0000000000AE0000-0x0000000000C77000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1936	dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1936	dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe
1936	dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe
1936	dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd29311c0eec6f861161f45e7961e2d3_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3804,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
1⤵
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000AE0000-0x0000000000C77000-memory.dmp

Filesize
1.6MB

Download
memory/1936-1-0x0000000000AE0000-0x0000000000C77000-memory.dmp

Filesize
1.6MB

Download
memory/1936-7-0x0000000000AE0000-0x0000000000C77000-memory.dmp

Filesize
1.6MB

Download