192759448f01e4f14a7ce0a9f65ac0a2a0858f287b2a7cf60a229d5b42a50acd

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a87a6c0c2ee3a71180de899d242e836f_JaffaCakes118.exe
Size

28KB
MD5

a87a6c0c2ee3a71180de899d242e836f
SHA1

bd46f25b4dc8b3392fae512d3eadb26b4e4dd002
SHA256

192759448f01e4f14a7ce0a9f65ac0a2a0858f287b2a7cf60a229d5b42a50acd
SHA512

78c91e12223e60bc5d4ac8350c748b5d79b146c7e02ce6a58dcbcd5a5d5a06730a16b6c98d58bea186423c22c4ca15658fe5a4885b53c12151c69e2f3119c658
SSDEEP

192:/TUBoypok559NYg3Z3tVlUWaOnpNyiS+hpIzh1iLHN86u90yXUdGW8D30SQNEqC:/TUBoK5p13Z3blUbopD75xYHD30Svz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a87a6c0c2ee3a71180de899d242e836f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3104	a87a6c0c2ee3a71180de899d242e836f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a87a6c0c2ee3a71180de899d242e836f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a87a6c0c2ee3a71180de899d242e836f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3996,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:8
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0KP8BKDN\un[1].htm

Filesize
8KB

MD5
f5bf9e275f660fee859b93c23ee2b338

SHA1
efab7984549db7c52046ef5402c2a104b618fb33

SHA256
a40a1671332f2e6cffbe0a4bc99a61b8b1f5ba06a7da3173b0fd498788068898

SHA512
5e11506cf258e14a3789ea729da151d1752143f8671663974e7b5576af2b5eabc725f73ebf18a208429333cb49e1cc0e8926b1e24eada10e6f3fb759825c2ca5

Download Submit