Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 09:44
Static task
static1
Behavioral task
behavioral1
Sample
dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe
-
Size
378KB
-
MD5
dc2c503941547ab3ce8332583617637e
-
SHA1
0903f24d403f932d33b9cf1d70d6001aa35a1ccc
-
SHA256
28074284a0fcd3aa5a51d04c757ce2562a28ba826224b703295b088da0b33891
-
SHA512
ecd8c7d4dd2ab4187234044d84f76a151f6414ebf0e6bd14d664b3371b3c6c96484c959261a7ff68657298af9651dfbde8519932f9ae837b11a3b1ef295e6f17
-
SSDEEP
6144:sjqphrgSbdqx+69K5XiRUD7Eofd5Jsa+4gYHokZmuLFn+df/pwxhqMqyAdmiDKq3:aSbdoYBuO7Eofd5Ws3c8Fncf0hqHmWKK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1820 dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe 1820 dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1820 dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe 1820 dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc2c503941547ab3ce8332583617637e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1820