31e7f899ec30db2797600f9cc04f7c3487ce4d3428f7447af016905aee68f062

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
Size

968KB
MD5

eac3ef907cbdd9fcdbbb1eb0d7e25afa
SHA1

cf5a4bbad889d1e3d3655aeae94243d1b71fb707
SHA256

31e7f899ec30db2797600f9cc04f7c3487ce4d3428f7447af016905aee68f062
SHA512

6eae11f93adf10421071e65e902edbcda04c8d14ed8be22116590cad0f26e1009de82444904d170b320b92dc0dc83e842c0e2f33ceefe44f4dda28cf3f696b9d
SSDEEP

24576:q6WsEh1GXeQO2Our4MkO6H12ro8JG8Gf5l1nRobv:rch10ZO2OuUu6H0rowyfD0

Score

7^/10

discovery evasion trojan upx

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4780-2-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-5-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-6-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-7-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-152-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-162-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-163-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-164-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-158-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-154-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-153-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-165-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-166-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-167-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-169-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-170-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-172-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-184-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-185-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-187-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-190-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-189-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-188-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-192-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-193-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-191-0x0000000002380000-0x00000000024E5000-memory.dmp	upx
behavioral2/memory/4780-213-0x0000000002380000-0x00000000024E5000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
4780	eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac3ef907cbdd9fcdbbb1eb0d7e25afa_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\INH240~1\images\Grey_Button.png

Filesize
341B

MD5
3e21c454ad120482f2099ce4c44982ec

SHA1
27d0429e693a58d0667cb867df467bdda92a718d

SHA256
1ba3bcb175afb99570cb331f8dc88306c7fe14a424a7311e8ccbca5285d51079

SHA512
41038041171713a6229e794673447f4a5fc971fc70d778b447663866cdb56c6fcdef6e24df56e67bd62a13f7d67e798a925c931b0a46baefc3eee05031a52016

Download Submit
C:\Users\Admin\AppData\Local\Temp\INH240~1\images\Grey_Button_Hover.png

Filesize
255B

MD5
198593ed7fda78677ebcf6e2576b4bdd

SHA1
e203cc4e764f4c8e083073c1a44a6c8bd0966220

SHA256
2ce222b53057f8489cf72b71f24fc2fc0f8743569119bf8e57acb1a0595c988c

SHA512
41d4152584a01c7be6cefcad700163c9f216040b89e39e2865392a22999779ba85b7730a23651635aff1f85ae668911a93445630774c037afa981456f7c99031

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\bootstrap_22147.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\css\mainDlm.css

Filesize
8KB

MD5
7dbda90b95e990cd3553b5b245b323ed

SHA1
fe7b6bfcaf307a7c31457172fd43b3f6bedd774c

SHA256
8dad3e35c7571b485c66a519eaf0d8a0fc8e0f4e0a9a4398cf536cfcf40cdddf

SHA512
9afaca43d24b8f3e9a2c6443c592dbfffdf5aea1488320310485a6d73b27e78cd8c864631348ac53fbc138cd3cb38c0a1e90c9e8e47d5c52ef0fb6857e2d8558

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\css\sdk-ui\progress-bar.css

Filesize
506B

MD5
5335f1c12201b5f7cf5f8b4f5692e3d1

SHA1
13807a10369f7ff9ab3f9aba18135bccb98bec2d

SHA256
974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

SHA512
0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\images\BGD.png

Filesize
2KB

MD5
335a24011568627de62082173f5fef77

SHA1
a03195faa0337c6d0c26d1bcb67f4c0a749fdc18

SHA256
e80b2232c24870b3d983d7576dd4bd117f7352b57b72ba61a0295abf4f60d71d

SHA512
cfef83e7ce53e115a6faba9c7295e9ad085df098a04edcf8162d42203fca15457d0471626e09e73953635279afc298a148108d43ffc29862f6c22815f8056a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\images\Close.png

Filesize
207B

MD5
c222a4f3d309721c0898606960120266

SHA1
cdee967961a3ea87565ae7ca287be8ed20496160

SHA256
f638cc042b7ade6f43f2faf0077e020137562e559178396b7e975db39ac13df6

SHA512
db52224964ffd03fa65fddabea29d4f7c23840a18d1ad1028f228589c8c642280a762d2f4250159106f911455b8f0706a3b204dcbbb0484638d4f41f4f54a836

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\images\Loader.gif

Filesize
9KB

MD5
afc685139a108e33bd945d5a3ff64122

SHA1
0a8010919ce9b60896e23d0db54fc7473b350ecc

SHA256
4d70f45a9c69d8ce2e630214c1b2871454d631ccf9d88976470170d0e106acbc

SHA512
62cf2171cc4a8e0a2e19608571c465ec3c038dcbe0f9a054a3c14a809a434b89868fb080bc15f94a5e4caebf987eabec966cce12cab14d4ce05858a65058534f

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\images\Pause_Button.png

Filesize
577B

MD5
84b37cb510f50c8fea812eb308d3f03f

SHA1
d141a79feb407506709f051e55c55438a12fd3b4

SHA256
7bf800336671204de36b7d1f6ceffdff830040f51d21bc44f220f68d72cf492b

SHA512
3222cb5772a4e9b20de253914c0856c7e6383567df68fcf287801f6f79248f65957515e7ec4a44db1fbe910afeae8ca3349295c4bdf03df6aabde36f2aaa6b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\images\ProgressBarD.png

Filesize
812B

MD5
eabb61abba55f80af418fa1128d1548d

SHA1
a5ee1d55de2cc60966039120c830fc19cefb0351

SHA256
717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1

SHA512
d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\images\ProgressD.png

Filesize
104B

MD5
35a600a752d3074501de31a516860499

SHA1
51eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf

SHA256
14e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75

SHA512
046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069

Download Submit
C:\Users\Admin\AppData\Local\Temp\inH24062729631768\images\Resume_Button.png

Filesize
718B

MD5
9d31583bcfad58a6b9ddeaf44549a5e6

SHA1
98f4c693af708e02201de2aee31fe094dc3b0a9c

SHA256
e466a2db2f755d9eb68619439af37ff4e45559b7a3f476e226ab2a11aeadae1a

SHA512
9ddaaad53375f4d2874fe5c98b6782202d2bd975cdd9363796986dc7567368b94d9ec1aa3e839194097838b787bbd71d574540cf5b04fd04f10fa80d6a89e695

Download Submit
memory/4780-172-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-190-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-153-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-165-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-166-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-167-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-169-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-170-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-0-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4780-158-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-164-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-163-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-184-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-185-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-187-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-154-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-189-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-188-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-192-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-162-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-152-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-7-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-6-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-5-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-2-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4780-193-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-191-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download
memory/4780-213-0x0000000002380000-0x00000000024E5000-memory.dmp

Filesize
1.4MB

Download