1683066f95e4ba1738602aa34493481e138a877dbdb3f4892eb7c4720be10b79

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe
Size

2.9MB
MD5

a29f77b308aaf0db99159bf2fd546054
SHA1

821cd8259859d352a310925eac1fba5cd3fea223
SHA256

1683066f95e4ba1738602aa34493481e138a877dbdb3f4892eb7c4720be10b79
SHA512

3289bcfb88fd2c7de8386eeecff939289cb13cd3a080c0084932e407a2e90477ba876514c8a121689eb3e4e2a6eea04f1616ec157a733e9d272f4f425addfb6c
SSDEEP

49152:diUHXgZpqe9fA8NP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:w2gSdUgg3gnl/IVUs1jePs

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2664	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2980	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0007000000012118-10.dat	upx
behavioral1/memory/2664-27-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2980	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2980	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe
2664	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2664	2980	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2664	2980	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2664	2980	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2664	2980	a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\a29f77b308aaf0db99159bf2fd546054_JaffaCakes118.exe

Filesize
2.9MB

MD5
1472f528d0b1d65e5104355bfe692181

SHA1
ae713eb7794723f7cee02f63e2f8a9352ca62122

SHA256
beba3e811fb211fd2af0b682751b6bf38929a9a222fa15094c2f2f13bb95a11a

SHA512
905d4b6445f97b583614e1bce1d13661ca4b692365814d6e377e8d168540ff71fd030ccadf1193431b70c825144db7581749c0c39fca8e1d4e501f8caa61cc26

Download Submit
memory/2664-29-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2664-28-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2664-27-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2664-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2664-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2664-48-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2980-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2980-3-0x0000000000290000-0x00000000003C3000-memory.dmp

Filesize
1.2MB

Download
memory/2980-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2980-14-0x0000000003900000-0x0000000003DEF000-memory.dmp

Filesize
4.9MB

Download
memory/2980-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download