Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe
-
Size
56KB
-
MD5
6ffd6f8b22694067c82e43dfc5557c22
-
SHA1
3966a17f45ebf61f5238392ac4cc1524e5363e05
-
SHA256
da2d9f8ac559fcf2acc8094d563e93dafe1e2ff3dc89fe06ba91251ac688bf2d
-
SHA512
d7ee2cb9e71c2cbb2d35e56a888864635c0343ede00e5d7ea8d4249482d05b846ae989b291be62478d6ff31ea583e8a0eb632422a2a7486ac280767bba9a9eaa
-
SSDEEP
768:8wXYKHSRYu0HICf9+RV/FsQfH9S7i8tWCupoV1tsD9WO4wtVez:8wXYKVf9CsQ/MycnwtVez
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2724 6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe 2724 6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe 2724 6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe 2724 6ffd6f8b22694067c82e43dfc5557c22_JaffaCakes118.exe