82e29e0e39af8319cd9a8e454c1712f017460cb4d959286681b57aae0b74c932

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe
Size

2.9MB
MD5

c68bc4b4494c7b4b1c75525a3e7af20a
SHA1

c257088a64b9f1759d161d7232fb6f7b8abb5ffe
SHA256

82e29e0e39af8319cd9a8e454c1712f017460cb4d959286681b57aae0b74c932
SHA512

19bbc38961c017bf7bf2dda5322d25769be7680f9d95646a211e63e501c5e798bc9c917cdc79571cfeedf81966e964fefeca03a21bd14ebf5932855cb5a85729
SSDEEP

49152:nwJ+vL6syajqoltXB5bKycvd2zi4cP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:n6meaPXfKT8lcgg3gnl/IVUs1jePs

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2260	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2260	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2908	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2908-3-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000700000001211a-10.dat	upx
behavioral1/memory/2260-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2908	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2908	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe
2260	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2260	2908	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe	28
PID 2908 wrote to memory of 2260	2908	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe	28
PID 2908 wrote to memory of 2260	2908	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe	28
PID 2908 wrote to memory of 2260	2908	c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\c68bc4b4494c7b4b1c75525a3e7af20a_JaffaCakes118.exe

Filesize
2.9MB

MD5
991c7a486dae3b57b33f6140fef167e7

SHA1
f1ce69d25180da09a8190652213ce31280602448

SHA256
9bb9dee40444c87a44dbb6a93ea0506e2dab6a3a7a50dc437b1f4070f8f69d4f

SHA512
42962c05573bf5a73819cb970f226dcc527a971f3ea3ecc36645a650e5c3ec8b9cd9cfbd7c492f0c028a5eaee0249a134461f900e93a2ed08614878d98688933

Download Submit
memory/2260-17-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2260-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2260-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2260-29-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2260-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2260-44-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2908-3-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2908-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2908-6-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2908-15-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download
memory/2908-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download