e4b50c7d78233c0b7dc04ffa96b038ed52c0f3e2579b1b402d1d819c75e73779

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe
Size

27KB
MD5

181906b7d20a0b7ae63c03194d85dd52
SHA1

36d4e9ed072eaf4889b5434aa97e6c81494ab746
SHA256

e4b50c7d78233c0b7dc04ffa96b038ed52c0f3e2579b1b402d1d819c75e73779
SHA512

d6d2fee8fe261f3f483a69293d09c1f16401f02c641dcdca040ded23ea2e2506f7c5ee15afc9a199277fa486498e76c5c021a8d520de09531928f68caafba069
SSDEEP

384:KynQJ5E0rLEAENTaSs6j59Ldnkxwe1Xq1ZNkf6htH5+rQNHCKiSwN1jwH6:KyQJjLQls6jzJkKe1XqXw6wrQNH5ijm6

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002345a-9.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1476	taskmgr.exe

Loads dropped DLL 1 IoCs

pid	Process
1476	taskmgr.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\2024106123312.dll	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\2024106123312.dll	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msalzg32.dll	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msalzg32.dll	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002345a-9.dat	upx
behavioral2/memory/1476-16-0x0000000010000000-0x0000000010008000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	3080	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3080	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1476	3080	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe	82
PID 3080 wrote to memory of 1476	3080	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe	82
PID 3080 wrote to memory of 1476	3080	181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\181906b7d20a0b7ae63c03194d85dd52_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
  C:\Windows\system32\2024106123312.dll
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 376
  2⤵
  - Program crash
  PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3080 -ip 3080
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
942KB

MD5
61a8f02536ab07e430715b98bad49cab

SHA1
e28de42fc3a993305178f8eb422f5ace9ea8b175

SHA256
4f5ce43a424f1970c3a4d53ebd57c158180f30d60c71db329ee9eac772ef3bfa

SHA512
def5296894cacd6b6a86aa47d6fc33854ec4edb8d19a6800f02d6897e36ccc67769ce2fd81752a6b3091204f30747ff8cce6758b145cd115515dafaa0e9a14e0

Download Submit
C:\Windows\SysWOW64\2024106123312.dll

Filesize
7KB

MD5
b1d96ad88bdbb4950b41f8a60fc76c15

SHA1
4f7c4b3ea6506a17e16a63659b98f7e2fda1d97b

SHA256
3e507a9577c8fa94cde233e7fa99dedf3477080257ef89e086c9886219fc7a90

SHA512
8d0b2bbca6ae15171d4bbe06e0e2728506496cd13f821c9e309f3a7508f7300d67c9ff55610deb446b62219d95e6f318c1c5e17b485e197da754832e2a4f4768

Download Submit
memory/1476-16-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3080-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3080-1-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/3080-2-0x0000000077542000-0x0000000077543000-memory.dmp

Filesize
4KB

Download
memory/3080-21-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download