f5d984f8da9f7df520c7954dddd35fb005dcb3e9810608c9b9f329c8d3c723aa

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9cf03850686d71f3ae84e1f01600f2a_JaffaCakes118.exe
Size

1.3MB
MD5

b9cf03850686d71f3ae84e1f01600f2a
SHA1

746d70f963ee6ec7a4dbc8c9adb906b5bde6ae09
SHA256

f5d984f8da9f7df520c7954dddd35fb005dcb3e9810608c9b9f329c8d3c723aa
SHA512

bc094a6a5fb7439e91a38bc89acdc43b628d90dd4b103baf6962c921523a35a4045f68c8b17abb3fba76298e7e1cf7191150387c218496e7b5d937e1469de208
SSDEEP

24576:fCwPAqhzRTLLEy8y8P6LStyJrNU9Y/t8KHYCGVEYC/:fvhzR3w6oyrNwY/HJaE5

Score

7^/10

discovery themida

Malware Config

Signatures

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4940-0-0x0000000000400000-0x00000000006B0000-memory.dmp	themida
behavioral2/memory/4940-3-0x0000000000400000-0x00000000006B0000-memory.dmp	themida

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9cf03850686d71f3ae84e1f01600f2a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b9cf03850686d71f3ae84e1f01600f2a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b9cf03850686d71f3ae84e1f01600f2a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-0-0x0000000000400000-0x00000000006B0000-memory.dmp

Filesize
2.7MB

Download
memory/4940-1-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/4940-2-0x0000000002350000-0x000000000243D000-memory.dmp

Filesize
948KB

Download
memory/4940-3-0x0000000000400000-0x00000000006B0000-memory.dmp

Filesize
2.7MB

Download
memory/4940-4-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download