173dd7c6a70c7a5f4a05cd4fbd86aa55a0458839c4b90b3e81ea051df259c8ac

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe
Size

297KB
MD5

fe10852ebef567fb74d56ed921764ded
SHA1

70fe6f2a67b7c66c4c9243ea6bb89c7725f821e4
SHA256

173dd7c6a70c7a5f4a05cd4fbd86aa55a0458839c4b90b3e81ea051df259c8ac
SHA512

ce6d7f47c2a0214cb19aeb554de2fb1bc32876f4def64c2b894da0bad338c328d1f71c9771d436644408de724cb0618099f884fcd59658df162f91edf80f9039
SSDEEP

6144:ErJ0n+pwK3IjFZH6LlJ73taIDjQDwTgsBxsuZgP4t8DcO0twoS:ErJ0niwK386j3taYjmw9B6ggP4KcO0ts

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2752	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2480	RemoteAbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 2632	2480	RemoteAbc.exe	30

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-0-0x0000000000400000-0x0000000000494000-memory.dmp	upx
behavioral1/files/0x0008000000012101-3.dat	upx
behavioral1/memory/2632-6-0x0000000000400000-0x0000000000494000-memory.dmp	upx
behavioral1/memory/2480-7-0x0000000000400000-0x0000000000494000-memory.dmp	upx
behavioral1/memory/2180-15-0x0000000000400000-0x0000000000494000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\RemoteAbc.exe	fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemoteAbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2632	2480	RemoteAbc.exe	30
PID 2480 wrote to memory of 2632	2480	RemoteAbc.exe	30
PID 2480 wrote to memory of 2632	2480	RemoteAbc.exe	30
PID 2480 wrote to memory of 2632	2480	RemoteAbc.exe	30
PID 2480 wrote to memory of 2632	2480	RemoteAbc.exe	30
PID 2480 wrote to memory of 2632	2480	RemoteAbc.exe	30
PID 2180 wrote to memory of 2752	2180	fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2752	2180	fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2752	2180	fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2752	2180	fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe10852ebef567fb74d56ed921764ded_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\165747.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2752

C:\Windows\RemoteAbc.exe
C:\Windows\RemoteAbc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" 90377
  2⤵
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\165747.bat

Filesize
218B

MD5
9cda595254191b96c01973727b93feb9

SHA1
f0f3ef4b522a070742781c6a2fad73cb3899a809

SHA256
5c5596a0bca7c879920b32d3113fd126b0315d12812dacd43a4ff6036df95c23

SHA512
fec67c409e8bd49391f382493dd4861b182189aee6b672adb00f3008d9d19d104e7dd45202f7560a8775f5074ada1e784c1df96ba393b0c5a04876ad3c687626

Download Submit
C:\Windows\RemoteAbc.exe

Filesize
297KB

MD5
fe10852ebef567fb74d56ed921764ded

SHA1
70fe6f2a67b7c66c4c9243ea6bb89c7725f821e4

SHA256
173dd7c6a70c7a5f4a05cd4fbd86aa55a0458839c4b90b3e81ea051df259c8ac

SHA512
ce6d7f47c2a0214cb19aeb554de2fb1bc32876f4def64c2b894da0bad338c328d1f71c9771d436644408de724cb0618099f884fcd59658df162f91edf80f9039

Download Submit
memory/2180-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2180-1-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2180-15-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2480-4-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2480-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2632-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download