9571aa2f29e897c03c9746ca3170659f94189785560d500995bc974bd6895528

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b34a4226fe765b554bb4c4e3d539cbcc_JaffaCakes118.exe
Size

1.2MB
MD5

b34a4226fe765b554bb4c4e3d539cbcc
SHA1

969c8817db1da454165f19cf58e149a21886e6e4
SHA256

9571aa2f29e897c03c9746ca3170659f94189785560d500995bc974bd6895528
SHA512

eeaf0eb4c52bc302f81c0b2623dfb505921ff8ff819537f207a2ec16a701f617f70e077bd5a31817cf09e8351cb7ca2280e57a39ab8dd6a737a9eb4f6c404f1f
SSDEEP

3072:e66eJy4l5bToVm3kBRl3hSOCLBuMENsE7VRMU3QDPoa3G4+fpmtWYgo0zo7up+6g:exQA9OHSEL0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b34a4226fe765b554bb4c4e3d539cbcc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	b34a4226fe765b554bb4c4e3d539cbcc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b34a4226fe765b554bb4c4e3d539cbcc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b34a4226fe765b554bb4c4e3d539cbcc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...