6d3f3ced697c52212280fea1967d4482b93fc9aad99f2ac7a6741d0eb1775889

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b8b717006584a9a45c5fd8b9848854e_JaffaCakes118.exe
Size

2.5MB
MD5

3b8b717006584a9a45c5fd8b9848854e
SHA1

a771655c94ad36409b0955c54efe0907f3b99c88
SHA256

6d3f3ced697c52212280fea1967d4482b93fc9aad99f2ac7a6741d0eb1775889
SHA512

6c0bc378a2418b333895e57f9a46dba28c5f05470011debce1be3830fe48ada79011c3b3aa7cad477ad1a7e31e00091a462f2c6b78900a28b197a0dc8a6a7454
SSDEEP

49152:60kcK1H6umtOryVBNlxog68mFM1gcfPe1xzxXshW1H6umt4:6796vtOryVB3M8mOdnOz2g6vt4

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b8b717006584a9a45c5fd8b9848854e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3b8b717006584a9a45c5fd8b9848854e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b8b717006584a9a45c5fd8b9848854e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2168-6-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/2168-7-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download