5103d7f1f440612cc2d47a6eb0623ba6e3ef972e0ed11b4414d447b39aeb9259

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 19:47 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_95c9c8a661ecbf7a55c4b7c43cda7ff0.exe
Size

1.2MB
MD5

95c9c8a661ecbf7a55c4b7c43cda7ff0
SHA1

aef02da80b9727848838ed2446a22ea86fec8c91
SHA256

5103d7f1f440612cc2d47a6eb0623ba6e3ef972e0ed11b4414d447b39aeb9259
SHA512

23d5ac67183f2971a5ddebf108be7132075531718457ef52e2c3e8b15aaa8eab05cb2b686ad4b7ebd641bb306394155092bc5df3834362be18d266e231aa70ef
SSDEEP

768:k7Dviojm1hAJFeolguCMBadnpGuP16GJtT:k/2U1lHb4ouN6GvT

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016c4e-3.dat	upx
behavioral1/memory/264-4-0x0000000002D90000-0x0000000002D9C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95c9c8a661ecbf7a55c4b7c43cda7ff0.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95c9c8a661ecbf7a55c4b7c43cda7ff0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95c9c8a661ecbf7a55c4b7c43cda7ff0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:264
- C:\Users\Admin\AppData\Local\Temp\mog.exe
  "C:\Users\Admin\AppData\Local\Temp\mog.exe"
  2⤵
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\mog.exe

Filesize
7KB

MD5
7ca237df45877c5c2885b323bc311eb8

SHA1
2c09e1d0e5d7cb2eefc193bde8030ef4f978ec41

SHA256
1832ec5aa127ca1549892560088ff1177a872f83a253d4f9b508e6e40ff87c09

SHA512
59fcc6de1828cbe5f4869dca176a1a1edebe2390f9e47178e0f158eb13a7b340392457619d4552869c5c83a08283059dadf721e9144575f5615835fb549ca3c3

Download Submit
memory/264-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/264-4-0x0000000002D90000-0x0000000002D9C000-memory.dmp

Filesize
48KB

Download