a9d508a368872940e5d9188a86f809ca1e341553b1b66bf6ce531a2e2d3785b1

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 01:40

Target

dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
Size

685KB
MD5

dd6d34ebd3dff4065c1a199fd0626156
SHA1

cef6cc2c83990917b3b93ccd0bc14dc83ac80435
SHA256

a9d508a368872940e5d9188a86f809ca1e341553b1b66bf6ce531a2e2d3785b1
SHA512

097940f0ffd976774671d07755f11f266bb62e3ab9e0364e3fd4276d2f7d9e660a11ab0b8f9e7b635d3ad6cf228bf02b19c8a48abaf0dc1aec46353a5f666c9e
SSDEEP

12288:0AUAc8JSkPGTsMCCiCdY+dLoMeaS0/230eEySFjT:0AUA/J4sMLbdY+iMeaS0/2kZT

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	dd6d34ebd3dff4065c1a199fd0626156_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ultravnc.ini

Filesize
718B

MD5
ac9b422a5e3a3ae2359a4bbc4732aa5f

SHA1
206b5683a289ab385dcc8a0977508b43f98b1fc7

SHA256
4eff31f87e02c274dbdca57c6150dc7da991b8db6662a5f39c2aec6c35d08026

SHA512
cddac982956b693ca60cb6b3d3b50cf2e3162ad509dfb3f3958d6fd17114ffbf4f57c4376b942062e40e19be090bb61905387366a386653ad48cc3224e3a6c19

Download Submit
memory/1964-0-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/1964-1-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download