284feb3499c22ffa3f5976c68f809a33cd66c9c6ac80d980b44a905d458b11bc

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2025, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2b5f6ef5d84ab16e0efbdfe196233569.exe
Size

196KB
MD5

2b5f6ef5d84ab16e0efbdfe196233569
SHA1

4f382c974b0db18c7c54474a127cb2ddcb0105c7
SHA256

284feb3499c22ffa3f5976c68f809a33cd66c9c6ac80d980b44a905d458b11bc
SHA512

1ff28e2db3fa93de551d7d70d91010a465920928c50f770b10bf70e60333dac40fbaaef641fc74c3d1aa49e1988ae0e172e67caf8a63d1037084d75057f8b323
SSDEEP

3072:k4UTmlhcuRAgIJjjgFAldOBx9K13/Y5m/Fb7RB8yDyjyi3LA:k4UTorIJPgFAl0Tw13//dRe+cymk

Score

9^/10

cryptone discovery packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral2/memory/4092-0-0x0000000000400000-0x0000000000433000-memory.dmp	cryptone

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2b5f6ef5d84ab16e0efbdfe196233569.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4092	JaffaCakes118_2b5f6ef5d84ab16e0efbdfe196233569.exe
4092	JaffaCakes118_2b5f6ef5d84ab16e0efbdfe196233569.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4092	JaffaCakes118_2b5f6ef5d84ab16e0efbdfe196233569.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b5f6ef5d84ab16e0efbdfe196233569.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b5f6ef5d84ab16e0efbdfe196233569.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4092-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download