0d0cac8a3a3fd1833b368168e5c6877aded00bd97827d41b814acc7e874ddd8a

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2c5715d6a443cdd52fcadade27c0fb77.exe
Size

204KB
MD5

2c5715d6a443cdd52fcadade27c0fb77
SHA1

069cccc3d1331a0634870072fa8d8d6835142461
SHA256

0d0cac8a3a3fd1833b368168e5c6877aded00bd97827d41b814acc7e874ddd8a
SHA512

cfa5fdcd4190db8caa92a91b58e9ca5ddba49c9dccd1929cb2f5d884688529ac15a2fd1bd2f40a2ad18596da40c9413be88f16a8dd4b7465ab13de4a52e1f1db
SSDEEP

6144:74UTorIJPgFAl0Tw13//dRezhTaPOymVN:7z7FgFk+w1P/yUWymVN

Score

9^/10

cryptone discovery packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral1/memory/2384-0-0x0000000000400000-0x0000000000435000-memory.dmp	cryptone

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2c5715d6a443cdd52fcadade27c0fb77.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	JaffaCakes118_2c5715d6a443cdd52fcadade27c0fb77.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2384	JaffaCakes118_2c5715d6a443cdd52fcadade27c0fb77.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c5715d6a443cdd52fcadade27c0fb77.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2c5715d6a443cdd52fcadade27c0fb77.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download