19dcf30b500672c017c89fab919d8bd695eaf6e0680e00aa216778f68414dd0c

Analysis

max time kernel
140s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe
Size

24KB
MD5

fdef59f4f6431de43323408f36cd1cfd
SHA1

1fb78e5eae5de98a160d33a8d5b1405b1b5d59d4
SHA256

19dcf30b500672c017c89fab919d8bd695eaf6e0680e00aa216778f68414dd0c
SHA512

7b786dcaa84cf04e2ebf6ec45fcf2d3f95a667fdfd6a7c67cfea32b24d389d498221d2870bf2b72513690c8f86975bfb9cc9ca647840c8b1a352c70cc3b30c4e
SSDEEP

384:Ieq8c65XkVkdni07Rqy1dMl8CbFwYK3a0c4Y2Bm1ndBAI/+5esznXGyoojdd5tpa:M8cGw0nHqICnFwHax49Bm1nwI25eyjla

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2432	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe
2432	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/800-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/800-4-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/2432-11-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Vet4-67Nt.mid	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\Vet4321t.321	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\Vet4-67Nt.mid	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2432	800	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe	82
PID 800 wrote to memory of 2432	800	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe	82
PID 800 wrote to memory of 2432	800	fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fdef59f4f6431de43323408f36cd1cfd_JaffaCakes118.exe" S
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\Vet4-67Nt.mid

Filesize
24KB

MD5
369800959166db9e0f971458521fb819

SHA1
311026ee9e11538115ddc50c9d9aab2151ace444

SHA256
e3d47d999d58d1e57499f68bf07c4a7f9223986a71f31a9669066bb7c473e1c6

SHA512
4441c17f3c2c33cc0f3aa00ef463f10f0637742ef0e5cabc9b30fec98a9fb74121a4a1bafadc553d592e6dbcdff9052beeef2350b61a1a75abe6764754727794

Download Submit
C:\Program Files\Internet Explorer\Vet4321t.321

Filesize
31KB

MD5
211d0e15ef32a902dc07035eb8967766

SHA1
e30556a1de0d1a9e0e370193d6c876cad2d8b73b

SHA256
3a5b49f70d9c9c2f215710ab490dcc6033ae8028d632eb3beafdda3da6f77cb2

SHA512
09e6827f5f4c4f8b4efa6ed747e4ea315d5685d24215ffbbbd4c7cc80fe5dd741038ff2b75f8508c6e25877eec4c6f91f52408b43cddb9664414814bace6e681

Download Submit
memory/800-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/800-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2432-10-0x0000000000580000-0x000000000058D000-memory.dmp

Filesize
52KB

Download
memory/2432-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2432-12-0x0000000000580000-0x000000000058D000-memory.dmp

Filesize
52KB

Download
memory/2432-34-0x0000000000580000-0x000000000058D000-memory.dmp

Filesize
52KB

Download