70f1592f764b3904c45d7843a2c4fdb3a56a2c3bd9db1be03292a8f5b3f8c276

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43d6b021bf18d614f785b60a832b371c_JaffaCakes118.exe
Size

1.1MB
MD5

43d6b021bf18d614f785b60a832b371c
SHA1

875a2c0427111ea72c8fcc854755027cdb4d7c8a
SHA256

70f1592f764b3904c45d7843a2c4fdb3a56a2c3bd9db1be03292a8f5b3f8c276
SHA512

e33eda280e154f432e57a1dc79c4c6049d4df316333b6e8f20523eae0b7d82f080921cde5ef8e43084813f164b79b9c870b1fb25e94ffa922b059ce484e0d689
SSDEEP

24576:3+eTCviaaaNWrI98+yZYg4ja1U9rVgzIKrvKMfn5RZiM2rlEhI:ueT0WrI98+yZYgwuSrq2ILb6l+I

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43d6b021bf18d614f785b60a832b371c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2316	43d6b021bf18d614f785b60a832b371c_JaffaCakes118.exe
2316	43d6b021bf18d614f785b60a832b371c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	43d6b021bf18d614f785b60a832b371c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\43d6b021bf18d614f785b60a832b371c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43d6b021bf18d614f785b60a832b371c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-6-0x0000000076DA4000-0x0000000076DA5000-memory.dmp

Filesize
4KB

Download
memory/2316-7-0x0000000076D90000-0x0000000076EA0000-memory.dmp

Filesize
1.1MB

Download
memory/2316-8-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-9-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-11-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-19-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-13-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-39-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-51-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-15-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-63-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-17-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-23-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-21-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-27-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-29-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-33-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-37-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-41-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-45-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-49-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-47-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-43-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-35-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-31-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-25-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-53-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-69-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-71-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-67-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-65-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-61-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-59-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-57-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-55-0x0000000000A40000-0x0000000000B3A000-memory.dmp

Filesize
1000KB

Download
memory/2316-4672-0x0000000076D90000-0x0000000076EA0000-memory.dmp

Filesize
1.1MB

Download
memory/2316-4673-0x0000000076D90000-0x0000000076EA0000-memory.dmp

Filesize
1.1MB

Download