717cf8a93db55515edee1c52c98d2242392efacad2066ddad6a86162e7f19839

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
Size

359KB
MD5

eabc0711047f22cfa010d87015d43219
SHA1

8a47818434d47250ad00695a7f8e4055e4f78da5
SHA256

717cf8a93db55515edee1c52c98d2242392efacad2066ddad6a86162e7f19839
SHA512

b62c760d32b1d964cc65dbcfa956c6be419be5131e1e7c725622bc8b92a0f2ecf4f31172d4f0ce9fd304557574774c98d297abd4da88d2f78a4ed9d27ab89a2c
SSDEEP

6144:ZgRyiIWQFpUv4/B+FrM144XlzKlUAzYYbuewX79GtPuB8PxwPh79i5s/CoS9iP6X:3iMCv45+uK4VKXknewr9GBY85wPTi5sa

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-0-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2112-27-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2112-29-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2112-39-0x0000000000400000-0x000000000050D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2112	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
2112	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
2112	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
2112	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
2112	eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eabc0711047f22cfa010d87015d43219_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\eabc0711047f22cfa010d87015d43219_JaffaCakes118.data

Filesize
810B

MD5
bac8d6463fc07afe217976051e251d18

SHA1
3dfeb9c8dd6c2b6d439fc09fee93ea8fd80a4c74

SHA256
f7fdbd6b1d53c177c36aa71455230cab5b5cd78ffcb6039e852a1fbd92af63a4

SHA512
9a2e9654eb66c5d025a06615c90bdda1a50f8b77ed65be4ef784596bd35cd6ce1f453637995126b7ca0b1f0aa8f786cc5d6aa85d045851f9e64c9007db6efff6

Download Submit
C:\Users\Admin\AppData\Roaming\GetRightToGo\eabc0711047f22cfa010d87015d43219_JaffaCakes118.htm

Filesize
635B

MD5
33f09577707d079a40f706a18e126d92

SHA1
0cef1f55b72a84e584a51e79a6787ea78d74a603

SHA256
e7f6bd122fcb829793f4047a5b929668b0a91ebfe31247b479586ec6d8f2b378

SHA512
5538c5b4e538a97796bfc412b3a81449931a9bbc1fa4e69500a0b30b35c1259bda857f392d85d87893999098bc88a432f28d2f699fadc295709a75b8113933cb

Download Submit
memory/2112-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2112-27-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2112-29-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2112-39-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download