0c2659acfa099dbddce53477221d75194e7420df1d0ab943bba1401879b139c3

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe
Size

280KB
MD5

73377916de2934cb21e2e918fbb526e9
SHA1

4b5eadfa49acad86078cab5a4b7cef30d3015a25
SHA256

0c2659acfa099dbddce53477221d75194e7420df1d0ab943bba1401879b139c3
SHA512

12d008beb7f695250ae41fbeb6d63d14b7998a1b342c9b6993a36c593be536c7c302bc4014b4bf1c8c867e6be959aa49365c96cb5305c12a96b1fc64b95f497c
SSDEEP

6144:MgXiHomvG4ouMFAb4atslrX2zAeo0TYTiQs:9woudXstIo0TEs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1968	73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2912	1968	73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe	31
PID 1968 wrote to memory of 2912	1968	73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe	31
PID 1968 wrote to memory of 2912	1968	73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe	31
PID 1968 wrote to memory of 2912	1968	73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73377916de2934cb21e2e918fbb526e9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\mndelrec.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mndelrec.bat

Filesize
278B

MD5
2fbcc27acd25970675ab066f8d7f4d9e

SHA1
6eaf22b20dd12d3884dd4f6cb5896e87f2c4dd74

SHA256
1ee60b13fdaabc0962a974c47bfdf3126a2c66f26f7760a7a79676d268e146fc

SHA512
3b9b59107537af331aed74077f97cd0963c0869e7273a91d81c13bc338ecf6ee40706287fceb5095d86d1ccd02fb973f936561f2257a0e980038017e3f9dc6db

Download Submit