2f7993b8f0cad82dbba3bb5d7470b2f0f5a90843ec9e8a2bfc805a9c234360d7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f63791d5fb0a37ad545390aec105a435_JaffaCakes118.exe
Size

22KB
MD5

f63791d5fb0a37ad545390aec105a435
SHA1

33c22fbb88abaaf86f64d261cfffff76d9a95892
SHA256

2f7993b8f0cad82dbba3bb5d7470b2f0f5a90843ec9e8a2bfc805a9c234360d7
SHA512

041cd7b28322e2c472a53b418d76c7d2ee4bc833cd8e3b95ce6f9ee291b81ee29862d5a869c1ac5442da4aa817b93e4d0881a9fcc563d5aec5f27936414e8a57
SSDEEP

384:5dYpsXpkrJJC7JuOW+R3aA+mWLVZYKeo5EPhq7Zaz0qR38pYUhieGp1u9IPi:5cepGJizWOGYK447Uz0qB8WPru9I

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4628-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/4628-2-0x0000000000400000-0x0000000000413000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f63791d5fb0a37ad545390aec105a435_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f63791d5fb0a37ad545390aec105a435_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f63791d5fb0a37ad545390aec105a435_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4628-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4628-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download