15c48e3ac219f44e5d08798356c68148e18c086b92413f20b6fc921fa43cb0c5

Analysis

max time kernel
91s
max time network
34s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
Size

3.1MB
MD5

dc0ab3ace60f019e49619d66bc4880f2
SHA1

1444b44f72e9ae94143e1b07f58030ba8d126a96
SHA256

15c48e3ac219f44e5d08798356c68148e18c086b92413f20b6fc921fa43cb0c5
SHA512

3e1a73c951a54865062fef92ac562f11ec19da1712f86c9acd9d48a1a78332a9c9908d274dec81feaec6d81e2a8a14b633b89846325437960ad72589eff08633
SSDEEP

49152:eU6OTNCntyhxPw0Pelu8G5UozmzY7KqMFkQDnUt47tS83jVLxwY4s9:e/wIntyFPeoVOoHXu/nUt4EAZeYX

Score

8^/10

discovery upx

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
4	2756	rundll32.exe
6	2756	rundll32.exe
8	2756	rundll32.exe
12	2560	rundll32.exe
15	2872	rundll32.exe
16	2872	rundll32.exe
18	1000	rundll32.exe

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000195d6-68.dat	acprotect
behavioral1/memory/2216-110-0x00000000008A0000-0x00000000008AA000-memory.dmp	acprotect
behavioral1/memory/2216-100-0x00000000008A0000-0x00000000008AA000-memory.dmp	acprotect
behavioral1/memory/2216-86-0x00000000008A0000-0x00000000008AA000-memory.dmp	acprotect

Loads dropped DLL 29 IoCs

pid	Process
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2756	rundll32.exe
2756	rundll32.exe
2756	rundll32.exe
2756	rundll32.exe
2560	rundll32.exe
2560	rundll32.exe
2560	rundll32.exe
2560	rundll32.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2872	rundll32.exe
2872	rundll32.exe
2872	rundll32.exe
2872	rundll32.exe
1000	rundll32.exe
1000	rundll32.exe
1000	rundll32.exe
1000	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000195d6-68.dat	upx
behavioral1/memory/2216-110-0x00000000008A0000-0x00000000008AA000-memory.dmp	upx
behavioral1/memory/2216-100-0x00000000008A0000-0x00000000008AA000-memory.dmp	upx
behavioral1/memory/2216-86-0x00000000008A0000-0x00000000008AA000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2756	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2756	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2756	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2756	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2756	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2756	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2756	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2560	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2560	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2560	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2560	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2560	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2560	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2560	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2872	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2872	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2872	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2872	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2872	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2872	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2872	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	32
PID 2216 wrote to memory of 1000	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	33
PID 2216 wrote to memory of 1000	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	33
PID 2216 wrote to memory of 1000	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	33
PID 2216 wrote to memory of 1000	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	33
PID 2216 wrote to memory of 1000	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	33
PID 2216 wrote to memory of 1000	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	33
PID 2216 wrote to memory of 1000	2216	dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc0ab3ace60f019e49619d66bc4880f2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\InstSupp.dll",CmdProc --Level --Supp 528 --Ver 192
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\InstSupp.dll",CmdProc --Goo --Proc checkinstall --Supp 528 --Cid E370BCCB-0CFA-AC48-95AE-9FC1E28C1A03 --Tid UA-54395801-1 --Uid 239DA3632C20344C9D509D89623A0930
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\InstSupp.dll",CmdProc --Check --Supp 528 --Uid 239DA3632C20344C9D509D89623A0930 --Ver 192 --Did 1244
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\InstSupp.dll",CmdProc --Res "C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\nso5AA0.tmp" --Ver 192 --Supp 528 --Err 5
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
6424373caa9f6b2e1db7e0b907c9aed9

SHA1
f3fd9c9aa5e4a288a736dc3e071aeda0d371695a

SHA256
f12aa55433967de1281f41cfd1ff8b57623295d93b8d52b219bfba8102cea9ea

SHA512
65e68bed619aba7fdb0e493730a70a1eedd53861c364da3abb554dc33df03987d35059442782e1bcff3eae33947b6bbca8eaa23af3047b08e62fbd30bb779851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8132d35ace39999a18b75155ae67ecb

SHA1
6dc6e1545e1763e67afd6b177daf1452f86bfc7c

SHA256
f6ad87e479ea58086e012f5155061d62e741d2d28b798944c3bddc6add88d62a

SHA512
7c18b679028a2bee1659b5e8fa5474a18eb5b358ac43450e84cb3489e0c22934b40d660130d320c64057631617a29b53e51b73c9d8883573cd42bdf51e0c250a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
35a7a45f665cc4bfa452b0f5985b0a99

SHA1
d6ae092112c2994f2cbd72def279ce12abb684c1

SHA256
a1a3af4537bc1c27a6b46e01879e2da0f7a48026f8fef2fdce781b3232199375

SHA512
1a40a182c3cddc6e8c67b3216516d11a90c3dd8a23761a1ea695a76027f992effec61efe032fd54b6fca4f8d4d2399147050e94e6b74c8a6b903602372504809

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F40.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\InstSupp.dll

Filesize
555KB

MD5
95b5fe69699759b0c7a5bb386794e8f1

SHA1
6850cd24cba0693876b03651d15d35c139d09589

SHA256
0103350257e34df3a832d73753291545d1c243e89d8e7350bdf1bdad849c705d

SHA512
41e1beb7ebf86cba231a4f760ac0a6ba5062f920f0c4624daf46845b6b7be50b2de81260825535082606b4686c9a49ceecaff2436ca7a3dbbadef146c0cf5367

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\nso5AA0.tmp

Filesize
1KB

MD5
f2629d72af6471ba51326d7b8d72002c

SHA1
93d0720ecaf479daf8f69e3e652a9c8db5a047f2

SHA256
fa37f87888c32cf66d0d7a9d59d8a22690e9a65cd1ff6cbd0322b787a3ce6009

SHA512
8c8ac15b84fb34de85bacebb165acabf818fb0e5e7e3a2e33f6ad7c0016ca1f575e7219806694760492b0c1ad6415a9b2e3d2825b636bcd7a77db4e798b6ca6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF085000-BAE5-994F-8850-BCC9EC1F39FE\nso5AA0.tmp

Filesize
851B

MD5
16f65d27257780873ab75986fd809993

SHA1
0c087c626a9954a6d877031d5af25b2b981b240a

SHA256
b9c56a3e2e9b4aaea83afc714c4ea9923054eeef3f9daadbe51ed108b9ffabca

SHA512
fba18ac45b8001e13356db05d0ceab51262b5c3a081719f7a31dde1c54ecc6fa858a3b4e9aabac960a40017d61ba897de85c1c241efb33d43a22d14a52886297

Download Submit
\Users\Admin\AppData\Local\Temp\nst567A.tmp\System.dll

Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
\Users\Admin\AppData\Local\Temp\nst567A.tmp\md5dll.dll

Filesize
6KB

MD5
7059f133ea2316b9e7e39094a52a8c34

SHA1
ee9f1487c8152d8c42fecf2efb8ed1db68395802

SHA256
32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f

SHA512
9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51

Download Submit
memory/2216-110-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2216-86-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2216-89-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2216-91-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2216-95-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2216-100-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/2216-106-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download