01ce73c369605eba0ecd6173b5523df56094dadb9d112bd0f66bb3abae6df71b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bea22857e1b413569ef0eaec68d918cc_JaffaCakes118.exe
Size

106KB
MD5

bea22857e1b413569ef0eaec68d918cc
SHA1

aeadbf04fadd80b82038e2148bde4f2be351c491
SHA256

01ce73c369605eba0ecd6173b5523df56094dadb9d112bd0f66bb3abae6df71b
SHA512

79071c39c2046cdeac8249fba4b11e2be90aa3ab9407dc2526553f6e9fcfe56602c2fee9e660a9fd5536a76d497b783ff508cb482b5c0b4ed9a102e79c3cb44d
SSDEEP

3072:p65q4LVWyv8JBqKgs9I5puULBkLQHM+BOYsmP:E5HVWWWXjIHd9kLQHPymP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3464-0-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral2/memory/3464-1-0x0000000000400000-0x0000000000441000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bea22857e1b413569ef0eaec68d918cc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bea22857e1b413569ef0eaec68d918cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bea22857e1b413569ef0eaec68d918cc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3464-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3464-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download