59836044fdfd49365a48ffd9bbc143e621c3c26ac2bbbe95acdcd208ab627e7e

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0c94e607c7043db2482cdf655a04eb9_JaffaCakes118.exe
Size

264KB
MD5

a0c94e607c7043db2482cdf655a04eb9
SHA1

0c842e492ab0d6e3c79e8878b42245194590730b
SHA256

59836044fdfd49365a48ffd9bbc143e621c3c26ac2bbbe95acdcd208ab627e7e
SHA512

ae5d3d96014d8b63e6a25486b8aafc5cab2083540039495983fb020b2f9d1a53cb90c19958dddf7b3118314cc023316f86d45716618b97e3181006bccedfbeb6
SSDEEP

6144:ub74aNScQhnpfVcoLoOcfQx6D/TJH4aaScQhnpfVcoLoOcfQx6Dv4aIScQhnpfVa:jacJJafJnahJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0c94e607c7043db2482cdf655a04eb9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	a0c94e607c7043db2482cdf655a04eb9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a0c94e607c7043db2482cdf655a04eb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0c94e607c7043db2482cdf655a04eb9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...