f0904734ac420af8eb755b2fb4152da799a4bea8a0f271e01f2c0888f6e08a2a

Analysis

max time kernel
140s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

028d34ef76cbf0d7756af38036985573_JaffaCakes118.exe
Size

364KB
MD5

028d34ef76cbf0d7756af38036985573
SHA1

ab62988dda1a4a87d7dd897c1c2925b594f8181a
SHA256

f0904734ac420af8eb755b2fb4152da799a4bea8a0f271e01f2c0888f6e08a2a
SHA512

a6b7c71aa917ae0f542c717783cac03cf20efe955b4b35a0aed477f4bf71c87eb925101b32193cb1b658de5d9085c1f92089ede49f85fcceb6551f468374f434
SSDEEP

6144:gxJ61E0Fg0C7pzNZT3KUDEeuH4RU0yDaytuxcz7TPUhKuh91RpPaYoSMKS:gxgvC79NZTaGuwiuxu7Tkf91RpPdoSjS

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2400-0-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/2400-10-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/2400-11-0x0000000000400000-0x0000000000519000-memory.dmp	upx
behavioral2/memory/2400-12-0x0000000000400000-0x0000000000519000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	028d34ef76cbf0d7756af38036985573_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2400	028d34ef76cbf0d7756af38036985573_JaffaCakes118.exe
2400	028d34ef76cbf0d7756af38036985573_JaffaCakes118.exe
2400	028d34ef76cbf0d7756af38036985573_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\028d34ef76cbf0d7756af38036985573_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\028d34ef76cbf0d7756af38036985573_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\028d34ef76cbf0d7756af38036985573_JaffaCakes118.data

Filesize
584B

MD5
45c02fa9ec24b31b1a8683c82f6a19bb

SHA1
4507346ccba8726f56ec18242409de593145dc07

SHA256
1d7fc96d11b74099b695213e1dd437fd1aeff3df7c737267666e75d1fb5652e8

SHA512
36c654371230affcb6e155277291388deb64a3e867be03541cb38581c671061d34d5dc300319a4b10cb4e4a46a2434e1a16eea13865cd95a9af30e0e8c061b96

Download Submit
memory/2400-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2400-10-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2400-11-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2400-12-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download