cc4b5776f45793f9c9ce92491d229f0df75e7483ed985e875d8bf726ed1cca18

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a449938fb58578a388b2fa3db97b9448_JaffaCakes118.exe
Size

101KB
MD5

a449938fb58578a388b2fa3db97b9448
SHA1

68584c168b84d69b1cfd89161bc22449a0cc24fe
SHA256

cc4b5776f45793f9c9ce92491d229f0df75e7483ed985e875d8bf726ed1cca18
SHA512

6d104155bb6300d7accd521abf800dca4cdd5847b9d6f12ba91b9a74b823da2c727386a36864db2ecfd7a6de759f83d3962ed75ecc3c05a9f00f360629ccf3fb
SSDEEP

3072:U42U65mXkJzU439/0LmIa3IWIGphvAuRk4sSn:UeNRLVaPpuuRk/Sn

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a449938fb58578a388b2fa3db97b9448_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a449938fb58578a388b2fa3db97b9448_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a449938fb58578a388b2fa3db97b9448_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...