Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 18:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe
-
Size
52KB
-
MD5
b487284bae18ef8d75f553efc3836b36
-
SHA1
df0f0440170f5846eb3d37290ab9f76358974c47
-
SHA256
61a6d7cc773862826d270984852ee481ac54a7732f638b1af229f0b3a3e3a48c
-
SHA512
25b8ba8620b32c7cee45f3a59fa147612cebd0d28892dd73f4cd8ae7a143c7206c3d50b46120ee15b264d3202f415a2185956640387f3bd1f699ca87e148c669
-
SSDEEP
768:VAGqzVnr73PrlqjDIcwH1CcWjGcahU5Nj9TtGCKeauVbK/uDiq:aGS/ZqjMUUiR9TwCKeaug/Fq
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2680 b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b487284bae18ef8d75f553efc3836b36_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2680