Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-08-2024 22:18

General

  • Target

    81f2a82620b6bd0e7af12059811dc04b_JaffaCakes118.exe

  • Size

    234KB

  • MD5

    81f2a82620b6bd0e7af12059811dc04b

  • SHA1

    9b82c93da2f5c63dab38c900dbcfc07dd9050e57

  • SHA256

    a5ac28825b49a818d6f8834ef0223e379f1457b7973135d9917b7ca307cb281c

  • SHA512

    dfdf90ae3f78e5d19570de09a72f3d539a011b931bfd96a53bbaaecab5a3ae1264f26ba6958bcd8652d4296fd54c88b0e9ea227bbc884da038525c4c14fae8d0

  • SSDEEP

    6144:AFfnHSNo1/zSGvGUxLk8r0Ei6eK+9xB6MsH9FNL8oS17:IfyNoVS0lLkhEi6n+/BgNL8oSB

Score
7/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\81f2a82620b6bd0e7af12059811dc04b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\81f2a82620b6bd0e7af12059811dc04b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1780-1-0x0000000000220000-0x0000000000234000-memory.dmp

    Filesize

    80KB

  • memory/1780-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1780-2-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1780-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1780-4-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1780-7-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1780-10-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1780-5-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB