9189f5e1ac30b2b6b754c01d1dbcc398fd5e731c2808af0b922dbf1516815e7d

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

78c8d43763dd28a9798d8e59b8c8fa53_JaffaCakes118.exe
Size

657KB
MD5

78c8d43763dd28a9798d8e59b8c8fa53
SHA1

a5ef532d0ee32890ae1eff44d5c718092f991801
SHA256

9189f5e1ac30b2b6b754c01d1dbcc398fd5e731c2808af0b922dbf1516815e7d
SHA512

fb829215def1b1becfd745da30a1c12b261df34601d4933b197c768f5c20d0f4f1a805421549cea42cdc4cc475fd514eb8bd809225777cbe494337a18d9429a1
SSDEEP

12288:sQGOp1dM77/vG8GyYs/dwvFFY1rStCAxx3o7yT6dNeXZGsS:6+1677W1yYs/dwvFFYEsAx1GQyEZU

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\system\update	78c8d43763dd28a9798d8e59b8c8fa53_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\update	78c8d43763dd28a9798d8e59b8c8fa53_JaffaCakes118.exe
File created	\??\c:\windows\system\reload.bat	78c8d43763dd28a9798d8e59b8c8fa53_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78c8d43763dd28a9798d8e59b8c8fa53_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\78c8d43763dd28a9798d8e59b8c8fa53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\78c8d43763dd28a9798d8e59b8c8fa53_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1956-4-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1956-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download