2db4d02745a0f854149257aa47fda939bd4b7cf3efc004aa84b17c01161565ba

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
Size

103KB
MD5

3a91316b87a09c7daa216df9eea2380c
SHA1

285dc2246cdf969d0a4a00a13248f3023c40c132
SHA256

2db4d02745a0f854149257aa47fda939bd4b7cf3efc004aa84b17c01161565ba
SHA512

355b0d028aaf5e2df1db3ea0321d2f2da72d5e1be7d142d0bef05ec758cfd0e57f91e6bec18c2f84d5a2168f56d1fc45459cc3a11f8d275a58aa3cfa45c0d4e8
SSDEEP

1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMqgCZVstJ7g:blN9RkkkkkkTLqDX6Jo10HK

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4836-2-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x0007000000023cb4-7.dat	upx
behavioral2/memory/4836-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Counter-Strike fix.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\DAoC + hack.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\UT2004 trainer.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942(fix).exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Sims 2 + serial.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\Counter-Strike(patch).exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\UT2004 trainer.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 cheat.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\Counter-Strike fix.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\Quake3(nocd).exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2 + hack.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike_fix.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\phwLgzIvGk.com	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\BattleField 1942(fix).exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\Sims 2 + serial.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\DAoC + hack.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Quake3(nocd).exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 + hack.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2 cheat.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
File created	C:\Windows\win32dc\Counter-Strike_fix.exe	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a91316b87a09c7daa216df9eea2380c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Counter-Strike fix.exe

Filesize
106KB

MD5
ea5c8851daa8488cf48aba195239a27d

SHA1
5f98dd9c6b6d8715aba9bb030ba3d54893096225

SHA256
04215cef14645e47cf4b1d97d001bb50419b236459cc93d7304fcb69d847b805

SHA512
1d10908170d87fd69683f1ef7f8496415ba6551eb50b8d34bd47ed3ba10297e4c8fdb3c5f35ea53c8bf700100a685df6b402a464b5d0425463a7f78949a9fb01

Download Submit
memory/4836-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4836-2-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4836-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download