695658c56097aff7e756a26d106c703553716fc1d3d409f436ae96c12b119b62

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 18:03

Target

52fafc6369e46d98efecaa5df3d2188a_JaffaCakes118.exe
Size

4.8MB
MD5

52fafc6369e46d98efecaa5df3d2188a
SHA1

9caa9e94cc1bc748a87ff2f10ad0d062f0be59c1
SHA256

695658c56097aff7e756a26d106c703553716fc1d3d409f436ae96c12b119b62
SHA512

2a9957e18d836c4dfd96da59df05624d750cc090dc3a67da12c3a73e02ea5f582edc224c08f9ae630067aea1d2aab109abb081e541a9270db5230cb13a1b2ef3
SSDEEP

98304:9wUZg/otQ3G2To+ZPLE8+QiB//dPlpKjCghL7XvLTAFzEPt3FHSQF/V/4dWp:zZGp3GEZoPB//XpKjCcLjYFzEPDHSKtx

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52fafc6369e46d98efecaa5df3d2188a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	52fafc6369e46d98efecaa5df3d2188a_JaffaCakes118.exe
1968	52fafc6369e46d98efecaa5df3d2188a_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\popcfg2\files.cab

Filesize
4.6MB

MD5
19ff469481b6b923691ee800d5c86f59

SHA1
80f4f03ec4d00e472cf0d25a3b850ff9aa4bc44a

SHA256
eb4c73b0af65431bcdf2567baeba37f66d66b59deed8ff6c067d6d5aa53e02ea

SHA512
7897e9d7bf1953ecc0999b78dc0731dc153504004e786d0ba7b1c309c7c801efe5d15c8607d43efc231b6fe750dbf4ef7a8315a03ff44241d5ce109132b0663a

Download Submit