Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 21:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71583e15e8d7698ff7e9f657207f99e2_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
General
-
Target
71583e15e8d7698ff7e9f657207f99e2_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
71583e15e8d7698ff7e9f657207f99e2
-
SHA1
4f92a5f714cdd93ba509faad5c005183d0354b4b
-
SHA256
82183597faabfea15ea130c69c552995bb299a5c9f792c5c542a76ec26786ae4
-
SHA512
025f92180acca10e43a2c9ebb8ea9d80f61f54059be16d7d8b0c42c741fa88f41ee57363b1410f38aea8dc55d0984067a13fddc24c3bd3b4957b8b9f825dd13d
-
SSDEEP
24576:kFGBDWdG6xZjqtEbTiX914hBilP4yGikVVXFZ+de6:kgBDEWuXw9qh8lQyGiGVP+g6
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1820-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-56-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-54-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1820-17-0x0000000010000000-0x000000001003E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71583e15e8d7698ff7e9f657207f99e2_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1820 71583e15e8d7698ff7e9f657207f99e2_JaffaCakes118.exe 1820 71583e15e8d7698ff7e9f657207f99e2_JaffaCakes118.exe 1820 71583e15e8d7698ff7e9f657207f99e2_JaffaCakes118.exe