f75fbe2683cf4d9533264cacc0f1c56dd214cd896a4bd1a04cff4cc71799019b

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

74bf389069f8de7f52276bd33e08fe98_JaffaCakes118.exe
Size

469KB
MD5

74bf389069f8de7f52276bd33e08fe98
SHA1

e8f9e51f5e6bceec6fbebab0a5161e2e2b2b15e6
SHA256

f75fbe2683cf4d9533264cacc0f1c56dd214cd896a4bd1a04cff4cc71799019b
SHA512

c998c12517c50cbb0deec80b555259da5dd89017e7465055fc2c72af42ec6b83b547c5f99e24998fe3f89a4746f3400c0feb344013b0bbd93ca98188ddf5618d
SSDEEP

12288:jFA66rn5nMhICFwiTHmnM/27hI4pAfbK/honYf:/6r5pCBTHmJhn64how

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74bf389069f8de7f52276bd33e08fe98_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1544	74bf389069f8de7f52276bd33e08fe98_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1544	74bf389069f8de7f52276bd33e08fe98_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	74bf389069f8de7f52276bd33e08fe98_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\74bf389069f8de7f52276bd33e08fe98_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74bf389069f8de7f52276bd33e08fe98_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-1-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-5-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-3-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-0-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-7-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-25-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-27-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-11-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-9-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-23-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-21-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-17-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-15-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-13-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-28-0x00000000779F0000-0x00000000779F1000-memory.dmp

Filesize
4KB

Download
memory/1544-48-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-55-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-178-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-30-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-32-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-34-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-36-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-38-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-40-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-42-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-46-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-50-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-165-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-255-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-164-0x00000000779F0000-0x00000000779F1000-memory.dmp

Filesize
4KB

Download
memory/1544-163-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-66-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-64-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-62-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-60-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-58-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-56-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-52-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-44-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download
memory/1544-259-0x0000000000340000-0x0000000000392000-memory.dmp

Filesize
328KB

Download