09efaec8248131e15433f5d7c711c626e46b5c78eae321a481c52d2815af7995

Analysis

max time kernel
140s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
Size

644KB
MD5

ebccd8bfc0a5c6e78b50e91bd0382ecc
SHA1

d089bf28f40960f9b25342354f2f83dd69255073
SHA256

09efaec8248131e15433f5d7c711c626e46b5c78eae321a481c52d2815af7995
SHA512

11a572e4ac82b3626eaea7fe2a796c94b9e54c4f6217c074916c0d3f8164b2fc9a7214a97351a23611c18391f51016c053b67f37d447f1a31c7aa44041d326d9
SSDEEP

12288:H0l3/eAxPXdygKDc11XrmOUI6GaadPgJhFSNFBRcZi6IqpnmOcDGLb0tCful5mQ4:Ul3/eANnyE6GzIXoNFoE63hmdDob0weU

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2400-14-0x00000000004E0000-0x000000000051C000-memory.dmp	upx
behavioral1/memory/2400-18-0x00000000004E0000-0x000000000051C000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Skinh.she	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
File opened for modification	C:\Windows\SkinH_EL.dll	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
File opened for modification	C:\Windows\Skinh.she	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
File created	C:\Windows\SkinH_EL.dll	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
2400	ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebccd8bfc0a5c6e78b50e91bd0382ecc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
e0a3903690c2c760163c748440071b44

SHA1
c3ebcbac015b3f698adfe9adadac7b05f4093ce0

SHA256
602fda08cca4a8e102cef7f9ef7f9e5e1eade71c34189621f93e58b9e9aab00b

SHA512
494481c4502697d870062dd067495351104d19a960bb0fb6a248e855dadb3e7981a8d65d723a0cb5db488b775a146baf67623daef93acdd35a95cbce11ea43ed

Download Submit
memory/2400-0-0x0000000000400000-0x00000000004573A2-memory.dmp

Filesize
348KB

Download
memory/2400-1-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2400-2-0x0000000000400000-0x00000000004573A2-memory.dmp

Filesize
348KB

Download
memory/2400-5-0x0000000000400000-0x00000000004573A2-memory.dmp

Filesize
348KB

Download
memory/2400-8-0x0000000000400000-0x00000000004573A2-memory.dmp

Filesize
348KB

Download
memory/2400-14-0x00000000004E0000-0x000000000051C000-memory.dmp

Filesize
240KB

Download
memory/2400-17-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2400-18-0x00000000004E0000-0x000000000051C000-memory.dmp

Filesize
240KB

Download