a9416eb45ba48f124da93ba1e9c82eb78b68ee65e374b0500a29ff7671476b3f

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
Size

789KB
MD5

523baed63951682f6e63d67fe0e42d4c
SHA1

8fa381c2ffc4bba36bdc7cc5115ed8081cfc2ebc
SHA256

a9416eb45ba48f124da93ba1e9c82eb78b68ee65e374b0500a29ff7671476b3f
SHA512

f3944be3ba20328530c2153274cd3aa297e1fc0a0f0487959504f5c20ee015a9bc71d2cbe05bc30adb64035c6a41335735e1c11fa4d616ab2af3c8785bdc6fc1
SSDEEP

12288:T55n1GqIrVesz6ZA6FPK2GhErItdwroJtOVB8IMIAap5VTEG2hCjNpO/kzeSXSm3:HvgeKIPzMEktdHJQVibaTRVHjNpIk4E

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/844-0-0x0000000000400000-0x000000000055A000-memory.dmp	upx
behavioral2/memory/844-2-0x0000000000400000-0x000000000055A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
844	523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\523baed63951682f6e63d67fe0e42d4c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-0-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/844-1-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/844-2-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/844-4-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download