e9f0135109c3d0c0e02af6bfb7378041c30dda7297cfc94c35a71337d2309a08

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe
Size

2.9MB
MD5

b4f04bd9169deac6d7f7c179d85f9e65
SHA1

96af667c1efdf629d9d7467dae8b53cc775c18af
SHA256

e9f0135109c3d0c0e02af6bfb7378041c30dda7297cfc94c35a71337d2309a08
SHA512

c8a2cc072cbf1bbfc70ec0cdd29f875fa63a31f9c4b879bc7eb970fd3b36189fffe41cff43db3a030e6d78c734264960f1a78966dd03db9cf337501e9716231b
SSDEEP

49152:9AtzwKekq9qSrQN/ipwg1V4MFP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:CFwAIzrQtihTgg3gnl/IVUs1jePs

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/852-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000a000000021649-11.dat	upx
behavioral2/memory/4356-12-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
852	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
852	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe
4356	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 4356	852	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe	83
PID 852 wrote to memory of 4356	852	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe	83
PID 852 wrote to memory of 4356	852	b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b4f04bd9169deac6d7f7c179d85f9e65_JaffaCakes118.exe

Filesize
2.9MB

MD5
23ce506c0604d33cc537936b29abdbf8

SHA1
458e6acf8542f728a221027bcc85950a47bc2d9c

SHA256
6544d1d8f3794cced124ededd4b54e43284fbe22327215f44cfc278976c40e69

SHA512
597e45e60b884d7cb0922df03acb47432de24797615ead077fe16a20635b584ab3f5e128351e6d57a08446f4a6201071b35e9d8e134f03ea11229486dbe29ba0

Download Submit
memory/852-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/852-1-0x0000000001DA0000-0x0000000001ED3000-memory.dmp

Filesize
1.2MB

Download
memory/852-3-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/852-25-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4356-19-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4356-15-0x0000000001DB0000-0x0000000001EE3000-memory.dmp

Filesize
1.2MB

Download
memory/4356-26-0x00000000046B0000-0x00000000048DA000-memory.dmp

Filesize
2.2MB

Download
memory/4356-12-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4356-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4356-33-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download