Analysis
-
max time kernel
141s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30-08-2024 16:52
Behavioral task
behavioral1
Sample
cb40c157e93e8013af5447c28fd3b942_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
General
-
Target
cb40c157e93e8013af5447c28fd3b942_JaffaCakes118.exe
-
Size
704KB
-
MD5
cb40c157e93e8013af5447c28fd3b942
-
SHA1
16b0df235b3954c6e6b96f7aecc252f22bc021db
-
SHA256
b8d074da8531b10cee3844431f8502da1a3932586fb6fa82da7a38da44409026
-
SHA512
d4bf092e3c911aeed4f88d2327ee9300fb3cc7501ab85e47596fb620dd40667265ca05b29f2fba3eac6ba15b0c19d66b185ab214eb7ef7a68349bb4d5fa3303d
-
SSDEEP
12288:zIwR9YVsNiXfvHFhixCUlskyCeKfAA1T4uJjx7aEiC0:zIIYVyyvHjisayNZASwVaEt
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1036-0-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-2-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-6-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-7-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-8-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-9-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-11-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-12-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-13-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-14-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-16-0x0000000000400000-0x0000000000586000-memory.dmp upx behavioral1/memory/1036-17-0x0000000000400000-0x0000000000586000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb40c157e93e8013af5447c28fd3b942_JaffaCakes118.exe