3401c97ad12a1d6c162821879547bc87d9499697a4b27664e955965b41dbd282

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/03/2025, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_732d3b601f505b6d958a3d26c71eb13f.exe
Size

256KB
MD5

732d3b601f505b6d958a3d26c71eb13f
SHA1

7a79360f6d7c16232dcf90a8d8374ed7a45db18a
SHA256

3401c97ad12a1d6c162821879547bc87d9499697a4b27664e955965b41dbd282
SHA512

be9d3ab543da4d1288789b2f4a29e5fecf531ae51ba935cc50cfa1f472bddf5b7d8fcb0c51a881a36c274068a0a12cc58b405a7febca0336f937ed6889e8aed9
SSDEEP

6144:DwHYaR95PYLm8v0B1OJIuUGfduGYA91+66:D6Y29T8W0JI14uGYo+66

Score

9^/10

cryptone discovery packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral1/memory/1072-0-0x0000000000400000-0x0000000000441000-memory.dmp	cryptone

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_732d3b601f505b6d958a3d26c71eb13f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1072	JaffaCakes118_732d3b601f505b6d958a3d26c71eb13f.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_732d3b601f505b6d958a3d26c71eb13f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_732d3b601f505b6d958a3d26c71eb13f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download