a6b6337806bf52b04474c98ed8b0051d8b1949c11755966d233bf60854505583

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe
Size

1.7MB
MD5

31fff390b4cc19f4ca8d02f144a83b57
SHA1

acb9c42c46abf42d45e05625ccd398a44a114d7b
SHA256

a6b6337806bf52b04474c98ed8b0051d8b1949c11755966d233bf60854505583
SHA512

9383ec427243058b82fffda7e4f9ec733cb9baae06cb6aafa97a66aa39c65454c423a33e65a265127eb2c6fa3d4c0cbeae3e3fc8b379ab4a1f0806ac5c7ecf14
SSDEEP

24576:FbpadCJ8XnNbXUMCDouesiqN4AiJB3g791v4QDhlnOBvBO:RpadCJNbPiJBI94QDhlK5O

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3052 31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3052	31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31fff390b4cc19f4ca8d02f144a83b57_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-0-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

Filesize
4KB

Download
memory/3052-1-0x0000000000FC0000-0x0000000001178000-memory.dmp

Filesize
1.7MB

Download
memory/3052-2-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/3052-3-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

Filesize
4KB

Download
memory/3052-4-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download