51c7b779ff7765747cc67d81d968a2d4b34db66b5c87d98c19ef28f09a72c53a

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe
Size

1.5MB
MD5

3d1c843fc7f92cb7d83b7d4a6e8742e7
SHA1

e8efde9f7d53e25368f3257cc3eaa49a5b01bd3f
SHA256

51c7b779ff7765747cc67d81d968a2d4b34db66b5c87d98c19ef28f09a72c53a
SHA512

80fe29b6df782aa3b7b38c94cafc35046f995879fd15ca78e0572309e8627326d8c6874874a7aa8269aa0524892ab53e2b2e51f0134e3641e457ed211c921d67
SSDEEP

24576:b3vkElhbp82W14ojA/YW3Ai9XoaxsrLOaUF5g3V6JeKwATZhW:7vVWNAgWRsamEjVTZh

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2184	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2184	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2844	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2844-8-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012266-10.dat	upx
behavioral1/memory/2184-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2844	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2844	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe
2184	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2184	2844	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2184	2844	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2184	2844	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2184	2844	3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\3d1c843fc7f92cb7d83b7d4a6e8742e7_JaffaCakes118.exe

Filesize
1.5MB

MD5
f20fb84a4ec1794b55ae42b26560a93f

SHA1
c91bb2b83a6676415c04d7db47b45d5df67c4f0f

SHA256
93a10464caf8cb37723ba65f0e655e1887e924c73229a17bf0459e27678d2757

SHA512
64dd406173e608359e6ca448a7a92a8eabcd224a219ee07a77c1b19bd8bf26a2328520051443bfabc0b12b86cd05ceec8e87e0eaaaaf409dd77e452986c2aa39

Download Submit
memory/2184-17-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2184-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2184-29-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2184-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2184-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2184-48-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2844-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2844-9-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2844-8-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2844-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2844-15-0x00000000036A0000-0x0000000003B8F000-memory.dmp

Filesize
4.9MB

Download