90b7c57189d516240372453a3f87eeea6422d945db48a7400a7fbe74335e23cb

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf503c18760bac19f6279a1344de0ae6_JaffaCakes118.exe
Size

501KB
MD5

bf503c18760bac19f6279a1344de0ae6
SHA1

58cafd09c5cc30db0f5bfb39a0716e7bbe2793b5
SHA256

90b7c57189d516240372453a3f87eeea6422d945db48a7400a7fbe74335e23cb
SHA512

36c1cdac94e1dd87b0c1e61599e5d935a3f1cacac281a5a860bebc919aa6329f73c0c3bc3469ca98496dc54e34b0989ac6a7a06f804664b98f47746a2151ac3a
SSDEEP

12288:gHIaepBsEJouoAQk7UH3FjOsCI7Y8rIu0MoSWI0I1/fl:gHIaeumo0oXFjm2J0PI51/

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2984-0-0x0000000001000000-0x00000000010E2000-memory.dmp	upx
behavioral2/memory/2984-1-0x0000000001000000-0x00000000010E2000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf503c18760bac19f6279a1344de0ae6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bf503c18760bac19f6279a1344de0ae6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf503c18760bac19f6279a1344de0ae6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-0-0x0000000001000000-0x00000000010E2000-memory.dmp

Filesize
904KB

Download
memory/2984-1-0x0000000001000000-0x00000000010E2000-memory.dmp

Filesize
904KB

Download