558d803f8fa8ca706c99d8adec576d42dd2461dbc4fd0b92302b2a3e3789fc60

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c017b232b4d2328a60398b8b2b3fb02e_JaffaCakes118.exe
Size

244KB
MD5

c017b232b4d2328a60398b8b2b3fb02e
SHA1

a34ca0eac02e23e9ef5fb21c839f4466408dd7d1
SHA256

558d803f8fa8ca706c99d8adec576d42dd2461dbc4fd0b92302b2a3e3789fc60
SHA512

67d1fa5485bfd8b1e0b4ec2d3d064938a6265c64d3974bddbd333eabe7ed73293a788b549b708b2dd5ea7fbb90327f9370c2d2d8798f296f1a06b12a1e7affbf
SSDEEP

768:v7Zx6fSQxRZ5lloX/cVdqT6ygJdJ6e3jmKHPUOZb11dYZsyn2NM/3IjXY233333/:vetWX/cV5HJ6e3jmKHJJI/iXYauW2O

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c017b232b4d2328a60398b8b2b3fb02e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2332	c017b232b4d2328a60398b8b2b3fb02e_JaffaCakes118.exe
2332	c017b232b4d2328a60398b8b2b3fb02e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c017b232b4d2328a60398b8b2b3fb02e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c017b232b4d2328a60398b8b2b3fb02e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000001E00000-0x0000000001E01000-memory.dmp

Filesize
4KB

Download
memory/2332-1-0x0000000001E00000-0x0000000001E01000-memory.dmp

Filesize
4KB

Download