45904a2ad83b39e2a37c05f5612bde13f3feef22c8b72d83bb8013a934eee5a1

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe
Size

2.7MB
MD5

df390d482333c5ef4ef8b5808f82cd65
SHA1

be74236d9cd983e65cb566db08acebf2d24ea6dd
SHA256

45904a2ad83b39e2a37c05f5612bde13f3feef22c8b72d83bb8013a934eee5a1
SHA512

c4319ab88d1cdf271e642f974970b8b7953b7a82d3ec4ae5f4664209852451094d4838af880863c1a17b7dcef4dc738c148166364f24e69e8aa05fb8113e1d9b
SSDEEP

49152:sjpJpvaadQ7Nr9cR9Hqh6HkYWu9okb2ZBBcaAw/9rGm/Y6fsR9j:sFJB49cHKh6wu9Db29R9/YwsHj

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
880	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/880-5-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x0007000000012117-12.dat	upx
behavioral1/memory/2760-17-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
880	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
880	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe
2760	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2760	880	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe	30
PID 880 wrote to memory of 2760	880	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe	30
PID 880 wrote to memory of 2760	880	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe	30
PID 880 wrote to memory of 2760	880	df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\df390d482333c5ef4ef8b5808f82cd65_JaffaCakes118.exe

Filesize
2.7MB

MD5
795f63ec205667f5d94d1a4211589c1b

SHA1
2c0088434b885f41029f9a84206d80e23944eb09

SHA256
3bf9fcea0091bfc6dbab4e31d79646b9d88b7c0df6c43848347ed5de9362ccea

SHA512
28c53924d53fd3fbcc1d9d80442b19730742abe1feedc6a7017bb9ecfab68a7bff4cf5544547df7dbfe06caa96ed0e1c16b0eeebf6443aa24159618fd3ce96b9

Download Submit
memory/880-16-0x0000000003620000-0x0000000003B07000-memory.dmp

Filesize
4.9MB

Download
memory/880-0-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/880-5-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/880-6-0x00000000002B0000-0x00000000003E1000-memory.dmp

Filesize
1.2MB

Download
memory/880-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/880-13-0x0000000000750000-0x00000000008D8000-memory.dmp

Filesize
1.5MB

Download
memory/880-49-0x0000000003620000-0x0000000003B07000-memory.dmp

Filesize
4.9MB

Download
memory/2760-17-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2760-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2760-30-0x00000000033E0000-0x0000000003602000-memory.dmp

Filesize
2.1MB

Download
memory/2760-29-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/2760-18-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2760-50-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download