4b8c270b61e338e094c6c480ee04cffb86c48aa87cace2506a1b2dc35a067244

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa9a33debaadf0b55f28038dc66fbfa3_JaffaCakes118.exe
Size

388KB
MD5

aa9a33debaadf0b55f28038dc66fbfa3
SHA1

b03fc4b1df8d0d44fad4f5c2b621eb19af7c38f3
SHA256

4b8c270b61e338e094c6c480ee04cffb86c48aa87cace2506a1b2dc35a067244
SHA512

27f59659e9ab9810ac4f2f2b1d48bf7a5ba5daab527f587b276dac98da0e43cd34e19aad7d412bbb5d562bd508aef2065ab51f7264f1a93b664aafccf7572e16
SSDEEP

12288:ORaAeIF0WvQieNeUy8yGIXYgBy1+hJ4p:QaS0W4Dy8WIOFO

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\loader = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aa9a33debaadf0b55f28038dc66fbfa3_JaffaCakes118.exe"	aa9a33debaadf0b55f28038dc66fbfa3_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa9a33debaadf0b55f28038dc66fbfa3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa9a33debaadf0b55f28038dc66fbfa3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa9a33debaadf0b55f28038dc66fbfa3_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\config.txt

Filesize
186B

MD5
ddd7b9de2762817229b19dcca8e0c7ee

SHA1
709f7e1d87760ac2fd5423af466ddfc04090f1bd

SHA256
ed0c11884bf8d6680a7b9d9f96795df47aeaec1390d1d27acc228f80199aa72a

SHA512
80af0d507dcf9daed8bf0e967618a5fc4b5541076527f8b3af458b480bbeb060ffb6d2fc6c54eac1c2aab7e18192b8a00b8b4e9ae3dfc8cb809bcac1b25d86ec

Download Submit
memory/2700-1-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2700-2-0x0000000000390000-0x00000000003D7000-memory.dmp

Filesize
284KB

Download
memory/2700-3-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2700-5-0x00000000023C0000-0x0000000002435000-memory.dmp

Filesize
468KB

Download
memory/2700-4-0x0000000000230000-0x000000000023C000-memory.dmp

Filesize
48KB

Download
memory/2700-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2700-15-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2700-16-0x0000000000390000-0x00000000003D7000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads