af065902ce4ca1ba7acfc3b0d08be7e8ae1edd73d7f99a17c1e5b504d7f76e94

Analysis

max time kernel
94s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Size

13KB
MD5

0952a0a3751c5adc4c94e8b7a0be8546
SHA1

4bd79409e3cd7b1eec80350d334cd8433d7937d1
SHA256

af065902ce4ca1ba7acfc3b0d08be7e8ae1edd73d7f99a17c1e5b504d7f76e94
SHA512

1da986f545a7f499dbf1b9de1b3aae2a933be96114909d7f0d1a98743e662f717c63ad424e184ff441de906898fdb8271815b931de88a53059b6736951e26f00
SSDEEP

192:G0WPLOEYJFGY+fzWfzjwLUoeJ/RBkn30G90xHRc7o3TccU+TY0F+UtYtXae4W0v:G0WKDfg5e5RA30GyxHRio3gcUsHB9W0v

Score

7^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023456-5.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mst120.dll	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mst120.dll	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1936-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023456-5.dat	upx
behavioral2/memory/1936-8-0x0000000000400000-0x000000000040B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\PROTOCOLS\Filter	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\PROTOCOLS\Filter\text/html\ = "Microsoft Default HTML MIME Filter"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\WOW6432Node	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\WOW6432Node\CLSID\{3a50d55d-b7ca-416e-9eab-7bcd39f4dcf7}	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\WOW6432Node\CLSID\{3a50d55d-b7ca-416e-9eab-7bcd39f4dcf7}\InProcServer32\ = "C:\\Windows\\SysWow64\\mst120.dll"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\WOW6432Node\CLSID\{3a50d55d-b7ca-416e-9eab-7bcd39f4dcf7}\InProcServer32\ThreadingModel = "Apartment"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\PROTOCOLS\Filter\text/html	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\PROTOCOLS	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\PROTOCOLS\Filter\text/html\CLSID = "{3a50d55d-b7ca-416e-9eab-7bcd39f4dcf7}"	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\WOW6432Node\CLSID\{3a50d55d-b7ca-416e-9eab-7bcd39f4dcf7}\InProcServer32	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\WOW6432Node\CLSID	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
1936	0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0952a0a3751c5adc4c94e8b7a0be8546_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8B29.tmp

Filesize
8KB

MD5
1bbede5a2f723cb13f6ccf4b2dde867c

SHA1
2af751ca8f89a6dfa3d7a85e7744a29cc7049f94

SHA256
3e442b2477f9aa862ee755a802cf3f73b8a6704171d39d5747dc8a80f3028d47

SHA512
0804cb43bf9baa576aa3df7b5750bc623331a81c2f67bf064ee2dd778094fa1158aacf579551fe5a1e1ee85d126c657e909edb77850c430c6ccd975f5004ac29

Download Submit
memory/1936-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1936-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download