841411422b175d6d6121b8948e8ef3b8c9f058d89bbb300ee9ff62fd574c5359

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe
Size

23KB
MD5

ffb69f943c18e8c86bcc1adcbc2c3a0f
SHA1

e88e8f753a7688c1b39da91daf37cbb723b1af16
SHA256

841411422b175d6d6121b8948e8ef3b8c9f058d89bbb300ee9ff62fd574c5359
SHA512

1553ad286e788dff013e93da146e71de80568663f2b8eb769533b0520020b00905a38d6ebe96e3619e601fbc3c1c3b8cfdfbbc015970cd5d14e6cea507bc3508
SSDEEP

384:7CGdlVniST+9S1iyv8M005r5jTLCivM4Q+joI7HLiJTrHDlrxHl4HXc8DCtHJbw+:uxSk50d5ztvA+sSriBrHDlVHl4t2t

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0003000000011c28-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2192	ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118xz.dll	ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118xz.dll	ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-6-0x0000000001C40000-0x0000000001C53000-memory.dmp	upx
behavioral1/files/0x0003000000011c28-4.dat	upx
behavioral1/memory/2192-8-0x0000000001C40000-0x0000000001C53000-memory.dmp	upx
behavioral1/memory/2192-10-0x0000000001C40000-0x0000000001C53000-memory.dmp	upx
behavioral1/memory/2192-17-0x0000000001C40000-0x0000000001C53000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ffb69f943c18e8c86bcc1adcbc2c3a0f_JaffaCakes118xz.dll

Filesize
20KB

MD5
c293ed0137e61cecc759adacc92c1447

SHA1
1a232c3358e480c97f50d197f36277bb4d41b348

SHA256
e2e6e8fd7611121897a1570845d07841186758728c11e2b4ec5271cfcde140d1

SHA512
4054247fb7193b490624e104f75e9e166f40acf5283a34cb1a0022da9ff389c49d551476ea639104107625d39f63a6dfcfa9743e361c1923badcd03514ba2588

Download Submit
memory/2192-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2192-6-0x0000000001C40000-0x0000000001C53000-memory.dmp

Filesize
76KB

Download
memory/2192-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2192-8-0x0000000001C40000-0x0000000001C53000-memory.dmp

Filesize
76KB

Download
memory/2192-10-0x0000000001C40000-0x0000000001C53000-memory.dmp

Filesize
76KB

Download
memory/2192-17-0x0000000001C40000-0x0000000001C53000-memory.dmp

Filesize
76KB

Download