7643862b97a21142b331a86b5689606436166276994efa2d14318d0a8cb50a2f

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe
Size

77KB
MD5

e2c388fe00ab34229329cce9b52339d1
SHA1

ff4c49d6453ed55050aee111c58962ebf0710297
SHA256

7643862b97a21142b331a86b5689606436166276994efa2d14318d0a8cb50a2f
SHA512

28c3eb0af8ffd6bc2a47ca95339d0ac14ab1eb7fdf355f3846d7217ac023e243845fd74c43bba39a4564f87ce4dac7c9b18919c64166bcf409e253c2b2a5e567
SSDEEP

1536:G/neRC5/wmroN04LYWC1CblMCn5uDI6tlRh7gZVv2MAH6+g:m5omrPkounIsYRhcGMz

Score

7^/10

discovery

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000015d41-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1548	JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s32kcp.dll	JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\vknt.tmp	JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe
File opened for modification	C:\Windows\vknt.cfg	JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1548	JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe
1548	JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2c388fe00ab34229329cce9b52339d1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\s32kcp.dll

Filesize
22KB

MD5
2a49b50ef5d7b0add47f7318de5655cb

SHA1
88824905ecdbee1d1b104d84098e6d31b5441ffb

SHA256
daa77961614405b008b427263fe46c8db004e3cf637659aa94b2325332d207e9

SHA512
19ec41d781b269fa1e724e01f9ca6ba6fb63a8c93f313f1b688ede2eddae8b5dedd38d63451ddff05c448e845e0e2fe863b2a55276d12b6520406ea8760ae031

Download Submit
memory/1548-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1548-7-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1548-8-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download