59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Submit
Reports

Overview

overview

Static

static

JaffaCakes...48.zip

windows7-x64

JaffaCakes...48.zip

windows10-2004-x64

0323b4326b...02.exe

windows7-x64

0323b4326b...02.exe

windows10-2004-x64

0898a80dc2...92.exe

windows7-x64

0898a80dc2...92.exe

windows10-2004-x64

0aaecf7f77...91.exe

windows7-x64

0aaecf7f77...91.exe

windows10-2004-x64

150e8ef3f1...02.exe

windows7-x64

150e8ef3f1...02.exe

windows10-2004-x64

23e95ba676...7f.exe

windows7-x64

23e95ba676...7f.exe

windows10-2004-x64

28e7dc4aeb...33.exe

windows7-x64

28e7dc4aeb...33.exe

windows10-2004-x64

350b0d6ae2...d7.exe

windows7-x64

350b0d6ae2...d7.exe

windows10-2004-x64

3a6ebac4f8...ca.exe

windows7-x64

3a6ebac4f8...ca.exe

windows10-2004-x64

3fe801df14...4f.exe

windows7-x64

3fe801df14...4f.exe

windows10-2004-x64

41367ad447...00.exe

windows7-x64

41367ad447...00.exe

windows10-2004-x64

48f4749f13...77.exe

windows7-x64

48f4749f13...77.exe

windows10-2004-x64

499d936c22...82.exe

windows7-x64

499d936c22...82.exe

windows10-2004-x64

4b5a6926ab...d1.exe

windows7-x64

4b5a6926ab...d1.exe

windows10-2004-x64

4bb0d8eb6b...81.exe

windows7-x64

4bb0d8eb6b...81.exe

windows10-2004-x64

5de3d5a337...ed.exe

windows7-x64

5de3d5a337...ed.exe

windows10-2004-x64

Resubmissions

25-12-2024 03:42

25-12-2024 03:39

25-12-2024 03:37

25-12-2024 03:21

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 03:37

Sharing

Copy URL

Twitter E-mail

Static task

static1

vmprotect upx

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748.zip

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748.zip

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral4

Sample

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware stealer

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral5

Sample

0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe

Resource

win7-20241010-en

ryuk credential_access discovery ransomware stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral6

Sample

0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral7

Sample

0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe

Resource

win7-20241023-en

ryuk credential_access discovery ransomware stealer

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral8

Sample

0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral9

Sample

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral12

Sample

23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral13

Sample

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Resource

win7-20240903-en

ryuk defense_evasion discovery execution impact persistence ransomware spyware stealer vmprotect

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral14

Sample

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Resource

win10v2004-20241007-en

ryuk discovery persistence ransomware vmprotect

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral15

Sample

350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral18

Sample

3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral19

Sample

3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe

Resource

win7-20240903-en

ryuk credential_access dave discovery ransomware stealer

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral20

Sample

3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe

Resource

win10v2004-20241007-en

ryuk dave discovery ransomware

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral21

Sample

41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral22

Sample

41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral23

Sample

48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe

Resource

win7-20240708-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral26

Sample

499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral27

Sample

4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe

Resource

win7-20241010-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Resource

win7-20241023-en

ryuk defense_evasion discovery execution impact persistence ransomware spyware stealer

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral30

Sample

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Resource

win10v2004-20241007-en

ryuk discovery persistence ransomware

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral31

Sample

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral32

Sample

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware stealer

windows10-2004-x64

16 signatures

150 seconds

Report Analysis Logs

General

Target

48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Size

353KB
MD5

c1da8e9bc9dcf68ed2e281049e11740d
SHA1

25e8fe884ca927e91142dacaaf92fcb544da0058
SHA256

48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277
SHA512

68ed339320ae064f4245e68f14bc16275766d730c780392150755db474344582d405dd58ba5f5fde18b3057bc61f453fad6df78996934de48873c0ca2d4481af
SSDEEP

6144:fxN7Na77pLQFP2D97RrwWMIMq2Bt8GuSeBt:JN7w77yPcr7MIlcJuD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe

Processes

C:\Users\Admin\AppData\Local\Temp\48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
"C:\Users\Admin\AppData\Local\Temp\48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads