16abc211948786c3253d578652fad36bdbf880da1eae15f00765af23ab98a079

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe
Size

3.6MB
MD5

e2b607f3f474613fe29fe0ef227c73ad
SHA1

92757ea2a87795d56d90af61809ca539945434d2
SHA256

16abc211948786c3253d578652fad36bdbf880da1eae15f00765af23ab98a079
SHA512

2acbdce88774acfcb277a65b6e3b8ddfa2540bd2331610713dd00ff2db14bf42c3ede25dd0fb7227b692d1c2fdaa43cab2493623130ee6b6544b40d99dc490ed
SSDEEP

98304:nz2itsL3e1gkrCs6KoQRnKPQ38jYo8jXB:nzHtPWsoQRK43+U

Score

7^/10

discovery vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2332	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000400000-0x0000000000D85000-memory.dmp	vmprotect
behavioral1/memory/2332-1-0x0000000000400000-0x0000000000D85000-memory.dmp	vmprotect
behavioral1/memory/2332-5-0x0000000000400000-0x0000000000D85000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SkinH_EL.dll	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2332	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe
2332	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe
2332	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe
2332	JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2b607f3f474613fe29fe0ef227c73ad.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\SkinH_EL.dll

Filesize
688KB

MD5
bd42ef63fc0f79fdaaeca95d62a96bbb

SHA1
97ca8ccb0e6f7ffeb05dc441b2427feb0b634033

SHA256
573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48

SHA512
431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c

Download Submit
memory/2332-0-0x0000000000400000-0x0000000000D85000-memory.dmp

Filesize
9.5MB

Download
memory/2332-1-0x0000000000400000-0x0000000000D85000-memory.dmp

Filesize
9.5MB

Download
memory/2332-5-0x0000000000400000-0x0000000000D85000-memory.dmp

Filesize
9.5MB

Download