6e346a9132e830157afc4e481898c0412e5e7b58cbd874a5d625af025b78e6db

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
Size

124KB
MD5

417fb2eca2d02097f830477436c931c7
SHA1

f543e7f8639142059b562fee323f7f36c4b3e349
SHA256

6e346a9132e830157afc4e481898c0412e5e7b58cbd874a5d625af025b78e6db
SHA512

9b43c882db3a194503961fe0d537bf0be956aed4e7e1078172ccd8af64ffb9317ca07060da52c4edc44ca656c08156b00029b7d84cadac92b039a2f5db5c9cef
SSDEEP

1536:APaqYxQoPaOo2O/OBqSqtmQLgyx8+VCAXKi5DAylyehAsgek4VHkmOIga:LxFPDdOeMmaHuS1geNamjj

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3052	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3052-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/3052-9-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\D8BBD177.dll	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\D8BBD177.dll	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\D8BBD177.dat	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\D8BBD177.dat	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\wshmcepts.chm	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
File created	C:\Windows\Help\wshmcepts.chm	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD17D8BB-D8BB-D177-BBD1-8BB178BBD177}	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD17D8BB-D8BB-D177-BBD1-8BB178BBD177}\	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD17D8BB-D8BB-D177-BBD1-8BB178BBD177}\InProcServer32	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD17D8BB-D8BB-D177-BBD1-8BB178BBD177}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\D8BBD177.dll"	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD17D8BB-D8BB-D177-BBD1-8BB178BBD177}\InProcServer32\ThreadingModel = "Apartment"	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3052	417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\417fb2eca2d02097f830477436c931c7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Common Files\Microsoft Shared\MSInfo\D8BBD177.dll

Filesize
58KB

MD5
209723e48f59bf6761add6e51cf208c7

SHA1
a0c8afe8712da0dadbd308d0af1701d1107ba34a

SHA256
6a64e149ba841cba625df7775cf831aa8142d8b3665ec9f7ae2042c2d72bdd68

SHA512
bffe6ea7261c1bb35206362a1cccdf1114b91efb0ed4dd409cab78adad1042ee2b0751ccdc0e5ba33f59675246667c7b2c0762ab9c3c10b10ddd623d2ea6d19c

Download Submit
memory/3052-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3052-9-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download