6af8045b3610f8b4ea84b9b97718a7cf250e2459e418cea1ab4de5c2d2093e42

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
Size

300KB
MD5

c7adb8547622b1fc70eab846766b060a
SHA1

20dec3b7097559e2debfd593c57349b3bb4aa602
SHA256

6af8045b3610f8b4ea84b9b97718a7cf250e2459e418cea1ab4de5c2d2093e42
SHA512

e4437ba757f437f33454fa7929314cd9d139242459b43bf67a435e11d6c1c6d3d949a7bef768a6dfe93f24bdd42377895d6179c8ed23e60a7021ec8b351c67ac
SSDEEP

6144:/c0h522p3l04ZMSmIp3Uy28uhy/fF3iBVYR0Mdfn:Hhxp3lZnT9bD7F3isR0U

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BOT HI-LO\icon-48.png	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\ВОТ НI-LO	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\BOT HI-LO\background.js	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\BOT HI-LO\bookmarklet.js	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\BOT HI-LO	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\BOT HI-LO\manifest.json	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\BOT HI-LO\icon-128.png	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\BOT HI-LO\icon-16.png	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\BOT HI-LO\icon-48.png	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\BOT HI-LO\manifest.json	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\BOT HI-LO\background.js	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\BOT HI-LO\icon-128.png	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\ВОТ НI-LO\manifest.json	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\BOT HI-LO\icon-16.png	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File opened for modification	C:\Windows\BOT HI-LO\bookmarklet.js	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_259411114	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
File created	C:\Windows\ВОТ НI-LO\manifest.json	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c7adb8547622b1fc70eab846766b060a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads