80d3435fca1705487b5ac81565a13001293f50678f65d4af6f61fd6695a04b8c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05512a676e49008437e0ca14732e4154_JaffaCakes118.exe
Size

52KB
MD5

05512a676e49008437e0ca14732e4154
SHA1

c5af704c388c1d63677086b32c7d81226da3b622
SHA256

80d3435fca1705487b5ac81565a13001293f50678f65d4af6f61fd6695a04b8c
SHA512

d59c192b5316edea8aacf7bc14e24d114d90534d76aa1355ca4b700a6cbd658dba9e5f5784c22c073ac1c9862e971e45ab1b995ae5498a78f4395b61ca2fcf47
SSDEEP

768:/SG/9mR2QGT1qte68U7E/UOSp3frBltCWJVBd5Sfs:/SRYQGTQtP8t/nSRNuWVdH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05512a676e49008437e0ca14732e4154_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3336	05512a676e49008437e0ca14732e4154_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\05512a676e49008437e0ca14732e4154_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05512a676e49008437e0ca14732e4154_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CloneF_4.exe

Filesize
52KB

MD5
2e7d304c7252f06b11c5095bfa9af754

SHA1
a2964fd99d1d9b2b31101900c2f4d2bfabb274b2

SHA256
fca8a7afd03544723bb7c98f417b748428cf459ef454125182191eb0395cf27d

SHA512
8408c6c8b2940fb7d08b39e1f192be4f53dd17589f93497a31ed9c0fd345b09dd77cd427b97696090b790bce959efbcafa1260e05a897d26c2312957965817fa

Download Submit