18c78c6da260ab9daa1b5845aadff3f4eaa90fc043c57e9c03f6ad52979dc768

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
02/03/2025, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3d2383f255c3e3e7ca8148b717387542.exe
Size

188KB
MD5

3d2383f255c3e3e7ca8148b717387542
SHA1

74f47d00e04b1a4f3cfc92f3596842a3878c6cf7
SHA256

18c78c6da260ab9daa1b5845aadff3f4eaa90fc043c57e9c03f6ad52979dc768
SHA512

6fd99faa2b95d8a70571ba61087ac546eb1daba2159f0f32694e8590dd406b6a066ec00f1ac5dc870ca258a8916ec4ceeca3545cdacb54894fd2cb972d6236b2
SSDEEP

3072:Pp0LVdGyuXqqB8J2dks4vXhv1QGi0b9QCFu7DUPQnlhph8k3c1TGH:POLVdGBBB8Ok/9QkQSKUPQLjcw

Score

9^/10

cryptone discovery packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral1/memory/2520-0-0x0000000000400000-0x0000000000430000-memory.dmp	cryptone

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d2383f255c3e3e7ca8148b717387542.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2520	JaffaCakes118_3d2383f255c3e3e7ca8148b717387542.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d2383f255c3e3e7ca8148b717387542.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d2383f255c3e3e7ca8148b717387542.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download