e61bf52557ceaa66bf92b8157fab53771bdd80bfc423461a962d37ff05c6a03a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe
Size

23KB
MD5

0b8ddb5a2b38c9fca0e14dfb4b8e4a18
SHA1

44a793e0d683b222c4617bccb0555d9666f10666
SHA256

e61bf52557ceaa66bf92b8157fab53771bdd80bfc423461a962d37ff05c6a03a
SHA512

9dd27be0518cc7be5899dd3806f7580f9180b1ac651138b44a07fc0b3a75fcaa46ad784bb18a1536fab9d5ebcd92f74f2c21fc898cf49a5221723673e2f4a07b
SSDEEP

384:1Ah2wahDtVtsWzOSJRmnVEQBkEx+Ci1aW3rGZeiPQ+2Cl3pp9q:6h2xwWngnV7k8+CO3r2eY+CFpW

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2828	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe
2828	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4412-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/2828-5-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/4412-4-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/2828-12-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\System36.jup	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\System76.Ins	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\System36.jup	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2828	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2828	4412	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe	83
PID 4412 wrote to memory of 2828	4412	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe	83
PID 4412 wrote to memory of 2828	4412	0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0b8ddb5a2b38c9fca0e14dfb4b8e4a18_JaffaCakes118.exe" z
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\System36.jup

Filesize
23KB

MD5
be954512acabdfcf4fa5dcf38b2f6c80

SHA1
a7505d8d8120757e11d732f8513f081021136186

SHA256
a0fc1daf17e525456574788ad9062d2200df9600103fa8229d19ba5f61c03427

SHA512
edddd8e32c28972a00aec5ded9a2090f8c854fd1c357b080641277021d46ff8aafffcdcb1dd600da863a21a58e45f5f5768cd76d860e7721c621881e7247e4d2

Download Submit
C:\Program Files\Common Files\Microsoft Shared\MSINFO\System76.Ins

Filesize
27KB

MD5
4097fdd9bf5dde1470afde6bd6be9286

SHA1
fcd8b2040094fcf1d54ae539219d11a1d19f1d5e

SHA256
18deae81cc46a837fedc85af9ff2b144606226a7106ce68a45402e53f13b7414

SHA512
484d4a58a4b4161047633bbc9d65c98353222bce865b6162cf768e5e7e368a8d11bcd6976fcfd88e34524dde9573c44f29a8f448cd3867cf34c635e059bfaa66

Download Submit
memory/2828-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2828-11-0x00000000004C0000-0x00000000004CD000-memory.dmp

Filesize
52KB

Download
memory/2828-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2828-13-0x00000000004C0000-0x00000000004CD000-memory.dmp

Filesize
52KB

Download
memory/2828-35-0x00000000004C0000-0x00000000004CD000-memory.dmp

Filesize
52KB

Download
memory/4412-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4412-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download