b5488b014f41c790b98364a4e72e64ed052c26a7ce1a9e9e0629b405365678f0

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
Size

4.9MB
MD5

eaaf4eb71a73d13e24fd34b8689d651f
SHA1

c82375b33c871a1a4204379eecfa26e81719105b
SHA256

b5488b014f41c790b98364a4e72e64ed052c26a7ce1a9e9e0629b405365678f0
SHA512

5f24e6922d2c2ac4d30092edf52af3ee160344b7958066d69d003d89ae5397bfc1cd501d137fa1e9abf392579805c2838dc17f2e6b48f01352e795f0fcb01fb3
SSDEEP

98304:oOU4RrHe6y8hnGjEpvAlkrtGNEz4+tikzDfUYFhG14YjqML4LBaeChdczyT:qoDbyEZH5iLwMyY0L0BdcG

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1120	Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
1120	Setup.exe
1120	Setup.exe
1120	Setup.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015d66-169.dat	upx
behavioral1/memory/2368-171-0x0000000002CB0000-0x0000000002DCD000-memory.dmp	upx
behavioral1/memory/1120-174-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1120-186-0x0000000000400000-0x000000000051D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1120	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1120	2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1120	2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1120	2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1120	2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1120	2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1120	2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1120	2368	eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\SETUP_33314\Setup.exe
  C:\Users\Admin\AppData\Local\Temp\SETUP_33314\Setup.exe /TH_ID=_2552 /OriginExe=C:\Users\Admin\AppData\Local\Temp\eaaf4eb71a73d13e24fd34b8689d651f_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SETUP_33314\2.bmp

Filesize
49KB

MD5
f16cac11cdd9a1e67f85255053690043

SHA1
4f5563d172b8d1b206b8bcc71aee585b69529643

SHA256
a007057c52817ab78784ddef5b80237793811770b18211b02d5f3a5d0ea64470

SHA512
f3f3b090f81f64110dcbddfaa5d0d3a3c7f51c2c008abc69ba944ef49fce4360912928e7fa132dac257ff23ae9d97e7374673f8b9338a701fcbffe82d299b91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_33314\Setup.txt

Filesize
7KB

MD5
735e8162f782df1cc6242a3eadf14c90

SHA1
014ae64e9db22d1ede7ab1d8b003ac2fe62b73af

SHA256
98c722ccb048960bebb3a6708c8a74aa0bdae58b91e6b7ac53418c01e94a3134

SHA512
fc2e11d4df089700274d28c93b9872d1360032e4967803812d3376098c0372bcfef6d981bd567e3987e0eb417abb85dc8055b6226c1fd7072c4b191a2de1865e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_33314\Turkish.lng

Filesize
9KB

MD5
804628f42430e7e1369679ffcdbeddb8

SHA1
9686abd4434578a0c5d903f692fc5cf84444539c

SHA256
514591a72b1c29ad90c6c9443efccebdf420140cc114dec9dac22169f69074d4

SHA512
49a03f6c1449893de8d7d11dcec1148a18e70a36e05fa0ab8d8c409d06e73fbdbb2ff0f3156effeda7461b892118cee21d106c3bce890f9510810a30306e110a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_33314\tescilbelgesi.bmp

Filesize
933KB

MD5
5b54dedd479a106a3abeb27751c51c4a

SHA1
40f02653f10ddb4474a3589d0dec1c6ff0047533

SHA256
76e1c6e400e7d6f44934dcbcfc6ad6925b46e2304b9a2021c677013fa8d22f49

SHA512
6b461f4ef09814958f0f22aee99e932735a8b8d43f1162e82df46471a40dd4adc612e2a2d22c5ef825ca1509c6e8a0f1948f57627460bb4b6c3bc231b9f89e93

Download Submit
\Users\Admin\AppData\Local\Temp\SETUP_33314\Setup.exe

Filesize
348KB

MD5
e32027dcab3f4d1fe78a87f4cabae25d

SHA1
c6dbbc5e7b531929fac8ca6da112d92178ee8faa

SHA256
3a28d3ff286e73e0de361d195132f1de1aca0eb774b3206ef3d3e4c00cd3ae1c

SHA512
9ff3acfad2e6d14701d26803617e17ea969672b0cb0376e4fc9df1dc6e780eeb72764848eb6484d9df0e9dedb6c0560b8d451d60a6c86028efcf99bc3bda166a

Download Submit
memory/1120-174-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1120-179-0x0000000000520000-0x000000000063D000-memory.dmp

Filesize
1.1MB

Download
memory/1120-180-0x0000000000520000-0x000000000063D000-memory.dmp

Filesize
1.1MB

Download
memory/1120-186-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2368-171-0x0000000002CB0000-0x0000000002DCD000-memory.dmp

Filesize
1.1MB

Download
memory/2368-185-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download