fee1d595a14e5b2e4075a4f5e7b206604e7299f6ae4f44db46847d48da8519a7

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1b5d78138eea317f2c070ac1c707517_JaffaCakes118.exe
Size

1.2MB
MD5

d1b5d78138eea317f2c070ac1c707517
SHA1

d24860eb869b9dacf51bb7d21e255f13a2e67b19
SHA256

fee1d595a14e5b2e4075a4f5e7b206604e7299f6ae4f44db46847d48da8519a7
SHA512

74eb4f1082334c6768b99ee3c61eae908e6fd7d365d625b429b9d0edef82ef96807ba834ede9d53b4cf430ceebebda19f126af98e40158545800fe40069c1cd2
SSDEEP

24576:wQ8yUed0rKurU1Q/oD77AsnPNqbFmaioNq1mSF+QZJhBoxJ1sC:wQZ0MJnPNqjZ0w4JEr6C

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1b5d78138eea317f2c070ac1c707517_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2168	d1b5d78138eea317f2c070ac1c707517_JaffaCakes118.exe
2168	d1b5d78138eea317f2c070ac1c707517_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d1b5d78138eea317f2c070ac1c707517_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1b5d78138eea317f2c070ac1c707517_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uservar.ini

Filesize
233B

MD5
da8b236e292fe6c2e2c476cd74eff0da

SHA1
1a63d0ad6cdfeb9c1118ea625b8be5cdf00236ae

SHA256
5cbf3d6c909b70331f4543ac8dfec43fb80662a496446e88199077e3673ba8b6

SHA512
c58fb294ec0c2bc1a257951ee92cb75a971ead05e894a3dc0a81c891edfe3d55b9fcee1f5233b3aae861b9ab553896f6f1e3ec1134a13d324c56a84020591e31

Download Submit
memory/2168-0-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2168-1-0x0000000000401000-0x0000000000446000-memory.dmp

Filesize
276KB

Download
memory/2168-21-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2168-42-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/2168-43-0x0000000000401000-0x0000000000446000-memory.dmp

Filesize
276KB

Download