Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 04:46
Behavioral task
behavioral1
Sample
1636d07bdbb413b4ef95dc818db00ff4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
1636d07bdbb413b4ef95dc818db00ff4_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
1636d07bdbb413b4ef95dc818db00ff4
-
SHA1
54163c4562f01b6d9635a2ed835820fd5511ac31
-
SHA256
b5a19242114984a35022eaf342191fa6ecfc3b4be839aed98d798a51d0f0a0d4
-
SHA512
3afff087a2157c138f14d0b38d0b93a257f4458249e0c875d3552fd8c044276b883434d43f1668a407cb20677be0da404128d3281db0b7d18fd5fc5c2376541e
-
SSDEEP
49152:hSV+Bi70tIzJIJwzO9415GZS/ZoE71LGc2eC6JI/CfnU:hStYmzquO9415GZAVETeDI/CvU
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2212-2-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2212-0-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/2212-2-0x0000000000400000-0x00000000004C1000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1636d07bdbb413b4ef95dc818db00ff4_JaffaCakes118.exe