4534b9ac55add0116ba799a05b41575123a186afa06ece34fbb8152026fbcf1d

Analysis

max time kernel
94s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cea08e2418029918b4f1f8b80f0ee1f0_JaffaCakes118.exe
Size

24KB
MD5

cea08e2418029918b4f1f8b80f0ee1f0
SHA1

d334eee9fda86895d3711cafd14ea897bc1a306b
SHA256

4534b9ac55add0116ba799a05b41575123a186afa06ece34fbb8152026fbcf1d
SHA512

4e4ab2275e2e63d50a3925b68fe41fb9225278ff1d1ab9966ec5c8afd5daf513c7d8aa0bd3c49a72604d97ff4f0d2179a4a34c4641a8c3c5a24ed929662ef7db
SSDEEP

384:EL0rqUipFy/HKIyzDnxEphhK88wJBk3STyUOWDqrEM:xruAHOh8Tf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cea08e2418029918b4f1f8b80f0ee1f0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2096	cea08e2418029918b4f1f8b80f0ee1f0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cea08e2418029918b4f1f8b80f0ee1f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cea08e2418029918b4f1f8b80f0ee1f0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...