f415635fc5bf344e8a70249720949790e287068a359878f6a30c1daab1481438

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

753285cf902716ace3d6e97d7fd56198_JaffaCakes118.exe
Size

24KB
MD5

753285cf902716ace3d6e97d7fd56198
SHA1

03c4b64ee7dc9fdb5bed053e2d6438556f81d57a
SHA256

f415635fc5bf344e8a70249720949790e287068a359878f6a30c1daab1481438
SHA512

54ac8741c09b27cab09c9563c1455226845f5811b2b4fe20a56f236d6c555ba875b3426ec57ca85a33b2a5890b7b10d151d8371b589b7fe879f01ab96a1c35ac
SSDEEP

96:ax3Zjg5f2s0aGZ9yWD0bpYRSTT2UG6xudD+ZLK9RhERUzMWvqySwjir1nbDL4FWl:Z2vae7a9up+A9RhuYS/JbDL4FEWBEQq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	753285cf902716ace3d6e97d7fd56198_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3008	753285cf902716ace3d6e97d7fd56198_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\753285cf902716ace3d6e97d7fd56198_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\753285cf902716ace3d6e97d7fd56198_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\d[1].htm

Filesize
186B

MD5
ddd7b9de2762817229b19dcca8e0c7ee

SHA1
709f7e1d87760ac2fd5423af466ddfc04090f1bd

SHA256
ed0c11884bf8d6680a7b9d9f96795df47aeaec1390d1d27acc228f80199aa72a

SHA512
80af0d507dcf9daed8bf0e967618a5fc4b5541076527f8b3af458b480bbeb060ffb6d2fc6c54eac1c2aab7e18192b8a00b8b4e9ae3dfc8cb809bcac1b25d86ec

Download Submit