c96098f7a8c67a8e53e38f84231122c09efcb03268afa4b1632a5d77b36168b5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe
Size

3KB
MD5

abb9c6da1659ac4eb2cc9de483a5b31d
SHA1

972865b2d970e038741b23e6dc40c7c60689fed6
SHA256

c96098f7a8c67a8e53e38f84231122c09efcb03268afa4b1632a5d77b36168b5
SHA512

b2d4939b8a038abdbcc2e64ea9c68d187962bb90c71a43e51038bc0ac3e66a00f961a538486ddc711e46e7ee78799fd962b30308aca55da900fa2c7f5d33102f

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
1KB

MD5
4bc0404839ef0949c7d086b2d7dc66b5

SHA1
19cfefb66f281a6d86eb388ac6f93c9f9f423833

SHA256
9a54198bee4569bc2e7f30a9422b356af53da2e759ff6e9eeb6fcf8a40c4e55e

SHA512
10fd19ea81a517863786b39b4d09896c30fa1dd31b6ed32486f28b6f4b00a4df2daa5605bc4c9973f1fd22631d0789e958532519bdd9646c40b888544e395eaf

Download Submit
memory/2304-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download