baf92ed05428caff6c3ca0ad43a78c8d2b6e5ff260c00eb3471de840901d4103

Analysis

max time kernel
5s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d33fa92f7b760e54ca9dcd8e88c3059_JaffaCakes118.exe
Size

88KB
MD5

8d33fa92f7b760e54ca9dcd8e88c3059
SHA1

a359f7646752235195cb62b04d11b1491b1cb5cf
SHA256

baf92ed05428caff6c3ca0ad43a78c8d2b6e5ff260c00eb3471de840901d4103
SHA512

16156f69db255e35b4fde2e6b116da20191a4e0d56a2129de33caed82b36615efb607ac55c6ba5038be3369f53b64189930ba8efbfc86ecc2397b03b513142d3
SSDEEP

768:0gUYAW0otPFLfCLcemsuTHdeP/o/YfOGtDQ2LmGtN82P:0gFVCLcZz9eXQutMGfP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d33fa92f7b760e54ca9dcd8e88c3059_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2064	8d33fa92f7b760e54ca9dcd8e88c3059_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8d33fa92f7b760e54ca9dcd8e88c3059_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d33fa92f7b760e54ca9dcd8e88c3059_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2064
- C:\Users\Admin\xiobo.exe
  "C:\Users\Admin\xiobo.exe"
  2⤵
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\xiobo.exe

Filesize
88KB

MD5
d06740b5606f0dd786a7e5d2f3e275e2

SHA1
e99c56d922798a4c72c094b1a338c800fbcc37c3

SHA256
5262b8bb0f87b9b18606f6bfef456b899cb265b626285afdf1c555915f645e36

SHA512
f0eacd45d2e5e0600b73c0adfb391e409b7a82ec5595e8ea5d35532a3b1761ea9e870eef16b8069de94680792b30f15a67b1e0f9da18c9b5a4d99996ffb81c1b

Download Submit