963f18924c23f74cd5b83b1cb956e48f72b57e8003bd02ebb1ef301600292597

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e269a839aac6d6543853239a76093496_JaffaCakes118.exe
Size

1.1MB
MD5

e269a839aac6d6543853239a76093496
SHA1

6553d2a95724095ffe8b67fc7fe422cfb2e988d7
SHA256

963f18924c23f74cd5b83b1cb956e48f72b57e8003bd02ebb1ef301600292597
SHA512

8ab4f5328c12f6e97c132f4f571792fa79d4652db900d05f9b7e4f129431ee1406db86b7f274dd36d3742233032075aea9ea66e94c47217467b38f73c0854126
SSDEEP

24576:l0jGeeATg3gXSOvvxM1m359Ty37cAthGn5n/5Mz3gqTJgrFTEAXCJmG:KOLd1/7cAthGn5nRMxTWFTEmC

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1644-0-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/1644-2-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/1644-154-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/1644-155-0x0000000000400000-0x0000000000513000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e269a839aac6d6543853239a76093496_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	e269a839aac6d6543853239a76093496_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1644	e269a839aac6d6543853239a76093496_JaffaCakes118.exe
1644	e269a839aac6d6543853239a76093496_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e269a839aac6d6543853239a76093496_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e269a839aac6d6543853239a76093496_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ish259431331\bootstrap_20359.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\css\main.css

Filesize
5KB

MD5
224ce27420b9adf4491edadb3bc4ccda

SHA1
91d7a7984288713e8b82b1ec5ff36a7de8e8633c

SHA256
2e6dd307b58b6eab1ff4a51c5d532e2050de590deb80e3fc62cd2daefbd55393

SHA512
e28ce17f9dc7a730e95c0d1a6e50d08c4c4704bccee4bd396ebead971e55c75b2b1f26fd38e1749a3a468b04c1b52cffe8dba6da6ae45505f7cc50d098967600

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\css\sdk-ui\progress-bar.css

Filesize
506B

MD5
5335f1c12201b5f7cf5f8b4f5692e3d1

SHA1
13807a10369f7ff9ab3f9aba18135bccb98bec2d

SHA256
974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

SHA512
0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\BG1.png

Filesize
6KB

MD5
d2a826cfb8e441ebdead29bb0e1d1ed7

SHA1
b75f295cdf11977e5b2d74fcfddede5a82f59c06

SHA256
aa9c26e67a11beb0fbcbd569779f421079224ac8a3ff29251c0f8eae3e562a8d

SHA512
c8144812b9a9ce124bc1dae7ece948c042369b827695ef7f0916490568d32d37b19a91f6ec3b82fdbb9106539f6eda31dc9fdc657e9dc025b8f8aaac31604b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\BG2.png

Filesize
5KB

MD5
3ddb3f3052989498efba386b8a0c21d6

SHA1
9d66abc2ff7abb3282f3303a85de97d13811eb62

SHA256
2c845e3e3c1f48c0867bd39e39f5f81b114fe0d6f51302adb0f1231a372cbcda

SHA512
ee5eca9e2ce4baa967559326e313c84ff333858e6644f0b7ac805f4c221150cb52199cbd7feb36c9db3bc64a0773be7593027b55869fde9abb7349d3f24ec2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\Close.png

Filesize
322B

MD5
5b97212a9d8ad0865531c4941e20bde6

SHA1
61a0c546e8c2ac403ac2dc20587173c8e1418ffe

SHA256
d78b9e6c8cb83728615c7664d95dd2c3f11afd7bb4c382b0388ace743e2305af

SHA512
5ef7b48c1a543b370b9957a20821f802f5578bda83a4aa4ab6a8cb47d465da31fee9b2de709a439245d8526b337c35c0738f2f7ce6122da9e9600d25a3f84ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\Color_Button.png

Filesize
592B

MD5
499b602442514ccf3794f01c83909eca

SHA1
e1ee94a95c6690be69cc6215b8defcdc30a19d5c

SHA256
371e00281023b79884d559b67cc2db529da70c295dde53b812aaddb6181d73fd

SHA512
3946c5262cdc535fb9a928282216c59cf1a1fe349bded69086864cde2de2465b6a7d6425f9fb988c150d2bcc9491471f4930aea9397297e2e07d42e786241e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\Gray_Button.png

Filesize
291B

MD5
257b6acbb516ebf9b81d982e415ffad2

SHA1
132f7b288412911f0c7313e0e9c7da8294126791

SHA256
96c2f3a633fb04207b27caa7e391372d968728e6ae9eee71908dc7c9d8218048

SHA512
624650a5437bb30c076e2f370e123f22b5e80b4b4f97357504345338031afcbf09630b84373dfedc3a47b4322e33b92e72e683f69c9a7a47afed97bc3a9a7536

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\Prod_Circle.png

Filesize
1KB

MD5
239e096a673ac6c2adfd34f78aa6234d

SHA1
dc2c5fe032a777171cdd08cd8de040503b59f642

SHA256
39ec7a68971d5536e4c4d45e91943548b4ede65a42fd7ff3d89a03ac998d5538

SHA512
5c21d549d434844798655e40e331a6b03ff7d5d0f1f8c698395fd334f58ae791fafb361eb96566e0184e52a2fb59da7d6ab3b62a59e8e6b5b4d4d8869291618a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\ProgressBar.png

Filesize
469B

MD5
48b1d53e7b743bc1dc9ed2ab24d3e8d3

SHA1
798a0b8be166adadd45f70b38bb44d2bf9baf450

SHA256
c58d4eb376e7a08421deb20d039465db89bc26814425ed68df97df873d86cff5

SHA512
380acd30ef72f786d51e63885d295b02870ac7b0bb54712f3be488e5a38107902ba0137ba02584f1d974276325638dc9342d7edfd5cbbce80c1b8133745941b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\ProgressBar_Element.png

Filesize
246B

MD5
001862156596834b18af80203241ab75

SHA1
43786b8f6a46f0b94853f5cc1d5e20202c1ac311

SHA256
e8458a7e0d987fb72034de02df8562cc0c566622eeeaf9d73899fbe7cf46d793

SHA512
5dcdf43fd3aef06bf6c959cfdbe5ff704ed7330697cf36f2b07e0538b84d4ce8d44defbdf8d7f9b0b148229e39c2a61b0290a9e8d4016072ad32ea83fba1fdfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\images\loader.gif

Filesize
21KB

MD5
360281e85620142c3329848262da263d

SHA1
032ae1e422af859d78d172e918573fb0f55318de

SHA256
6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

SHA512
48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259431331\locale\EN.locale

Filesize
1KB

MD5
77765c009c5ab6d2f13961315751f645

SHA1
1c118a0e3557bd545fccce81a38ff29b51675dad

SHA256
ea60de0c44dbb70d9d9e6c6b1d499899f05f2132511f0a65be801de3f1294d89

SHA512
d5661b1d4f8ce8e30b396ee1077715e7d66483d6297ac813a5ac3f761dd87117166c64245edcad6e59aeb8d685ce2bd60a9216c19596c24646fc4aca23992e7a

Download Submit
memory/1644-1-0x0000000000401000-0x00000000004C6000-memory.dmp

Filesize
788KB

Download
memory/1644-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1644-2-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1644-154-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1644-155-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download