0d9f36b7b0719353a8f1c05a83863e5f1bee05183a47c792ef4a6b3768481a3f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88e3d2b0fef2c65e7eaf5d6ba2df25af_JaffaCakes118.exe
Size

239KB
MD5

88e3d2b0fef2c65e7eaf5d6ba2df25af
SHA1

1d8463ee10039f10f18a73e1ca549636e99b7763
SHA256

0d9f36b7b0719353a8f1c05a83863e5f1bee05183a47c792ef4a6b3768481a3f
SHA512

a46f4e8b848c61bd96826b9cb772351dfa994c716a7faec6ac2d84dc000ee3974b0819c40010f16ddaae949c3225bb3d7542e7ac21cbf58079914900d100e520
SSDEEP

6144:Eh1XHz15/zGCwYhxhgOHSXX9VvhkWzBe65FPjnP:ELXH3/zLJhx/yX1k0dnP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2532-0-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2532-1-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88e3d2b0fef2c65e7eaf5d6ba2df25af_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2532	88e3d2b0fef2c65e7eaf5d6ba2df25af_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\88e3d2b0fef2c65e7eaf5d6ba2df25af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\88e3d2b0fef2c65e7eaf5d6ba2df25af_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2532-1-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download