1b636bbadcdddcf2affee320c8f3409b67c577e877542d09e03d33389a06a6aa

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe
Size

44KB
MD5

9531903a43084ff2624ce1dd7b60cfc0
SHA1

417b89669654536baeff3c1fe59d9882b4f912fc
SHA256

1b636bbadcdddcf2affee320c8f3409b67c577e877542d09e03d33389a06a6aa
SHA512

68414a9ba8dc82129da07e598097eb688b16443aae19b0bf65c7eee1f4446162d2f2c66f0979e0a277dfde1e3d723410fcd6af0fccd47861af38027a174fdca5
SSDEEP

768:8FMMXXEwqAnDQ8q2rSPFflUZH+Dodejgotq18JkAVYTopg98aEMkybENj9qIFiV:6MMXXEwqAnDQ8q2oflGTdejgqq1EkAVE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2296	9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe
2296	9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9531903a43084ff2624ce1dd7b60cfc0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads