09eec58c24ab6a5c7588862f85876c087051cbc1f61c3f1a465f61470627fe88

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2057e2fdbeddf20e93c6e693d6e767e_JaffaCakes118.exe
Size

279KB
MD5

d2057e2fdbeddf20e93c6e693d6e767e
SHA1

89e80cb1cc79e8bb5d68809f01df5f08a75cb1cc
SHA256

09eec58c24ab6a5c7588862f85876c087051cbc1f61c3f1a465f61470627fe88
SHA512

b8967d98629ddfecf62f5facb119356d4ec15b15e603f957b5c297d5421852a119afcb257b0ca2724a8ef909f0a84aaf9019f43c49ad3935bd7f409ebaab53a0
SSDEEP

6144:e9wY04dKuFz5M6fxMihRsJLHBntcCtTtIS/LYtiXlIrUbN4Pg8Nfu4:e+v4FzrfxZgJR2YGS0tir4o

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x0000000000A7C000-memory.dmp	upx
behavioral1/memory/2240-2-0x0000000000400000-0x0000000000A7C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2057e2fdbeddf20e93c6e693d6e767e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d2057e2fdbeddf20e93c6e693d6e767e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2057e2fdbeddf20e93c6e693d6e767e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x0000000000400000-0x0000000000A7C000-memory.dmp

Filesize
6.5MB

Download
memory/2240-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2240-2-0x0000000000400000-0x0000000000A7C000-memory.dmp

Filesize
6.5MB

Download
memory/2240-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download