389d4631b59b2855dd43fedb32e16949a0385173790452ceb5553c96ad3adb92

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe
Size

56KB
MD5

dfe9c94a8fc4ba63278bbd257631ba79
SHA1

47ce923bf2f57974f222417f86059812b6e71b0a
SHA256

389d4631b59b2855dd43fedb32e16949a0385173790452ceb5553c96ad3adb92
SHA512

642bcd29e93fe53133fa9e1964cfdee2ac7436df13b5394b89f2ba7721e8271af18f8582b81adb2056689ea45e5b69d5a80d41281bb56bf2d926efa10ee462d3
SSDEEP

1536:yARPXghafrpteA8f68sPEBZqGf5fLpFviF0G:mhafzx8EP9uvvrG

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2920	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2920	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2664	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2664-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x000a0000000122ce-10.dat	upx
behavioral1/memory/2920-17-0x0000000000400000-0x000000000043A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2664	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2664	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe
2920	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2920	2664	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe	32
PID 2664 wrote to memory of 2920	2664	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe	32
PID 2664 wrote to memory of 2920	2664	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe	32
PID 2664 wrote to memory of 2920	2664	dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dfe9c94a8fc4ba63278bbd257631ba79_JaffaCakes118.exe

Filesize
56KB

MD5
dc63f0189d09ed4360de8e67a9e7631b

SHA1
25adda89b81c6964ff2a6387a902486e0c5e76eb

SHA256
b1f7db20428f44d6dfd0f3e3f007b049213c6e1622663588d0dc4b35323c53cc

SHA512
7d5993a435c14728708182ee393ef804826f436ae7b9c331a973aa1562cefe75fcc1e9e0ab5487084ef09c47517b5f5c854b476686e330bfdb3e721db62d5293

Download Submit
memory/2664-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2664-1-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2664-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2664-14-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2664-15-0x0000000000160000-0x000000000019A000-memory.dmp

Filesize
232KB

Download
memory/2920-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2920-18-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2920-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2920-29-0x0000000000170000-0x000000000018B000-memory.dmp

Filesize
108KB

Download
memory/2920-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2920-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download