cc1bac5551f80feba8dd3363cb133dc415862584ea930abe183b7949a4fbb3cc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5a804f7e2b75cff5feabd12d43ccfb8_JaffaCakes118.exe
Size

712KB
MD5

d5a804f7e2b75cff5feabd12d43ccfb8
SHA1

ded16959c864c8706f6e84adcbd86ce1f4e30157
SHA256

cc1bac5551f80feba8dd3363cb133dc415862584ea930abe183b7949a4fbb3cc
SHA512

8c9d4411067da2561a76a774bc0e2b896adbb8cd0a39a417be62e6f9451af1d7c3208bbdec175d9d50e955dc8d2b93f8d5be27e16cb4a7f9c613b3dd6c272a23
SSDEEP

12288:WApBhaN3mWda8wD59qonLOBVp0q+HDMf:WCWkWd9wPqBVp0q+Hi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5a804f7e2b75cff5feabd12d43ccfb8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	d5a804f7e2b75cff5feabd12d43ccfb8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d5a804f7e2b75cff5feabd12d43ccfb8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d5a804f7e2b75cff5feabd12d43ccfb8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...