12da6d7a03d9e7d5001c8e44a32119ca650cebdea12479e107f418672a9e904e

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe
Size

104KB
MD5

f6b7a3208de8533b73f7c8efea0d1309
SHA1

5bbe0e89ad1eb377b1f7d12cf9a80d7070367896
SHA256

12da6d7a03d9e7d5001c8e44a32119ca650cebdea12479e107f418672a9e904e
SHA512

6e45a230bcee32b45122e9211b1bc84993b8731c8b48139109f8ad22efd289b1a9e678e02dfe45b6cdf295c249b85bcf36f32a393fb1a846b656f870d5fc0a4a
SSDEEP

1536:eNBT7/kjIbTiEdBbqx6bOZEYhJgA2foNnz33AhsKKK3Z8Qwwnouy8+EnLhSb4N2:YXM0yEdB2x5TI0nbAT344out+ELhSb4c

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2256-0-0x00000000013D0000-0x0000000001412000-memory.dmp	upx
behavioral1/memory/2256-37-0x00000000013D0000-0x0000000001412000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2768	2256	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2768	2256	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2768	2256	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2768	2256	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
3KB

MD5
75b6b95547550cf70c4afb0073f93ece

SHA1
4d6b01939c7b5fc802bb4d9678268cc9e28e4fe1

SHA256
33b0f7363d84d8483135256d00a3b6bd27ced8e15ce7b0079a38de24135f43d1

SHA512
1c666c5564747754e4f238c9c0d67e21628eb7efc068719383cb1a8d758b88135c6e0355cc8958c8230bcdffa68f13552676c52daaed54fd2cd7e16acb084ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
4KB

MD5
57ceca122a790114f79ee9becbc5ef92

SHA1
83b5eb04232d40a239243373abf320518afeb5c9

SHA256
ab0a3c440e45b3a6e49ddcff6087d8eeac9ffd36c8e7e93c27cdcf1c5b2d14ba

SHA512
e438e057c8cc53ef7721f4a04954c532c3007d5109e3c296c7356f0c9f3b4a38d1a2614fa975305d6c0b542c2000a18568e4eb3ce1f98a7bed0d93c19b94aaed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
1KB

MD5
712c458dffd71bf090313036cbde58a7

SHA1
f3f16d8dff29b053ca927dbdde1059695a4b0e94

SHA256
d816b122e2add943c42408e25b9bb00194aa5a803e68c50da9a0f4897ac2a908

SHA512
90ccec820eef7302401efc12241c3450f1a8bbe307b62fed05d98ce9bf787fc3619bcbab5c9e778f50952961d6365a2392a45175bac304aae0f4a0d523c488ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\hd.vbs

Filesize
245B

MD5
d8682d715a652f994dca50509fd09669

SHA1
bb03cf242964028b5d9183812ed8b04de9d55c6e

SHA256
4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba

SHA512
eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca

Download Submit
memory/2256-0-0x00000000013D0000-0x0000000001412000-memory.dmp

Filesize
264KB

Download
memory/2256-37-0x00000000013D0000-0x0000000001412000-memory.dmp

Filesize
264KB

Download