70c37bdd3b713405867699d2d4a8e5bec187d4705cf120715c2684b980cb407d

Analysis

max time kernel
140s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
Size

654KB
MD5

0a7793152b5454dc3f99aec1731637dd
SHA1

80a6d43171beef66255489ba5b8d3749f5dfee0d
SHA256

70c37bdd3b713405867699d2d4a8e5bec187d4705cf120715c2684b980cb407d
SHA512

8ad84db276f3b9c8672b69623feca80d6201becc936b936e32f712b2dd2ceaa4727a58a54fd51b2917c33770fa9f787541e3ad3a4ca17f6e7fe6464b7ae7cafe
SSDEEP

12288:whjTlYxHNC7HpqCvzo6Adh2/xxwCo6NvnzeHB6Gr7ncrsiifbFF2X81YR5E:whjJYxHNC7Hpq+o6A4xv8HI2Fi2UX8Kw

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023431-4.dat	acprotect

Loads dropped DLL 5 IoCs

pid	Process
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023431-4.dat	upx
behavioral2/memory/2996-5-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral2/memory/2996-22-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral2/memory/2996-27-0x0000000010000000-0x0000000010129000-memory.dmp	upx
behavioral2/memory/2996-34-0x0000000010000000-0x0000000010129000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
2996	0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a7793152b5454dc3f99aec1731637dd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BCLIB\Exmlrpc.fne

Filesize
72KB

MD5
85ac41ef853b8b2a1b8dacb433e2ef9a

SHA1
6a6a82362791d1e18bd6212303ec625aaa06e1ae

SHA256
438ccbe15cfc07d64c092ab925a1d6d8daa3762780bf014da0e1e9814e80b688

SHA512
2b3ae985372ab52f5d39d637f01b4931ce4a5b62167d35e12342eac8990ee7fb3f2d6be45d136ba54d36867c34b39bd8a5967c9c400fae2e04a6d14099ef3b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\BCLIB\dp1.fne

Filesize
112KB

MD5
6d4b2e73f6f8ecff02f19f7e8ef9a8c7

SHA1
09c32ca167136a17fd69df8c525ea5ffeca6c534

SHA256
fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

SHA512
2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

Download Submit
C:\Users\Admin\AppData\Local\Temp\BCLIB\krnln.fnr

Filesize
409KB

MD5
c3d354bdf277263b13dca264ec2add9d

SHA1
b428dfd7df0f6024e22838823cc702e2293bd314

SHA256
ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f

SHA512
24c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e

Download Submit
memory/2996-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2996-5-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download
memory/2996-11-0x00000000021A0000-0x00000000021B6000-memory.dmp

Filesize
88KB

Download
memory/2996-17-0x00000000021E0000-0x00000000021FE000-memory.dmp

Filesize
120KB

Download
memory/2996-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2996-22-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download
memory/2996-27-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download
memory/2996-34-0x0000000010000000-0x0000000010129000-memory.dmp

Filesize
1.2MB

Download