e2f12e7baf73b29f9bc3f4311d8db6bcc21764b7214817221d03e7b76566b417

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1dcbfe57bb1fc433794e6f7e531eeec_JaffaCakes118.exe
Size

587KB
MD5

a1dcbfe57bb1fc433794e6f7e531eeec
SHA1

7d842e237877bc80b09fba787e3b2c959be6e0fa
SHA256

e2f12e7baf73b29f9bc3f4311d8db6bcc21764b7214817221d03e7b76566b417
SHA512

dd393d18b46eb257f12138e40724584c919f395a82fb6af3835f0456fbbecb7adae4a2c810b7b1ba2cc9439acbff4614b906510a783e969f1900462b317eb772
SSDEEP

12288:1tOSJpWFJj39z5PTLEo/83hUCsBfAnJ42wArL5Rgg:1t1Pc39zpT3/qRMom2wARu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1dcbfe57bb1fc433794e6f7e531eeec_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1868	a1dcbfe57bb1fc433794e6f7e531eeec_JaffaCakes118.exe
1868	a1dcbfe57bb1fc433794e6f7e531eeec_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a1dcbfe57bb1fc433794e6f7e531eeec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1dcbfe57bb1fc433794e6f7e531eeec_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-0-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1868-9-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1868-10-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download