160f277c217178f5a2bb2190bb02c66ec2511836e11876edf44a24919435bd09

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a37db9c3d9f424406a0514c2c31142b2_JaffaCakes118.exe
Size

263KB
MD5

a37db9c3d9f424406a0514c2c31142b2
SHA1

58b92e7438277273ab1b65bf90c8150419c14926
SHA256

160f277c217178f5a2bb2190bb02c66ec2511836e11876edf44a24919435bd09
SHA512

f58832ffa80826d43efc9cbf7d757ab4d1b7c724eabfd922725a367f3d61ab2908a1328f37efd3af60340a7bef17f02d94b5bfaa653e1d2a28d76d76ed083b20
SSDEEP

6144:WtsDbBUiG+f6R2hM/tmLVd8fJ2oZfXwojrpZgxC:vDbBUl+HhlLf8fYoZf5HpZgxC

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1676-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1676-1-0x0000000000400000-0x0000000000429000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a37db9c3d9f424406a0514c2c31142b2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a37db9c3d9f424406a0514c2c31142b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a37db9c3d9f424406a0514c2c31142b2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1676-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download