36ac70b931f186129817c6d8ba48c8a291e92163c272f84e2aea1c7aab7a79e8

Analysis

max time kernel
3s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df2141d3ea4313987fe8e0909f9f3fa4_JaffaCakes118.exe
Size

80KB
MD5

df2141d3ea4313987fe8e0909f9f3fa4
SHA1

8a050dddf55bb1d195318604d5128d9592715317
SHA256

36ac70b931f186129817c6d8ba48c8a291e92163c272f84e2aea1c7aab7a79e8
SHA512

6b0913843f5ef126d4b56de2f01f72fb7cb022660d0cd095826b1bb7ac236ff358a6379f3c349eca9f1499fbb04adcf9efb8e2f27bcd8be560fa4685cf0c56da
SSDEEP

1536:u2aRMQV2LELVpG/0NQBsc+JG5d47WiFGsdFvaeJYGGGfMX5FAaeJGYGGGfMqlGrr:eRMQRVpG/0NQMvL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df2141d3ea4313987fe8e0909f9f3fa4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2668	df2141d3ea4313987fe8e0909f9f3fa4_JaffaCakes118.exe
2668	df2141d3ea4313987fe8e0909f9f3fa4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\df2141d3ea4313987fe8e0909f9f3fa4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df2141d3ea4313987fe8e0909f9f3fa4_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2668
- C:\Users\Admin\nioco.exe
  "C:\Users\Admin\nioco.exe"
  2⤵
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\nioco.exe

Filesize
80KB

MD5
99d7442b29993a5886faf10b3c484a6d

SHA1
47b1006e89071ef11878967515e2089652544296

SHA256
3cec1ce071cb929ab6ccf10f5e116caf43a4e7d949b8019bc1acbc9f24c1491e

SHA512
5da1aed8fbc1ff7551c4854189e473a2f83916f137b89f404f0770b627735a8ad72343cb425ee867b9339b0604ce6a3606172556d4fbeafd7cbe5c1c58046ac8

Download Submit
memory/2668-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2668-14-0x0000000003980000-0x0000000003997000-memory.dmp

Filesize
92KB

Download
memory/2668-9-0x0000000003980000-0x0000000003997000-memory.dmp

Filesize
92KB

Download
memory/2668-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2668-14-0x0000000003980000-0x0000000003997000-memory.dmp

Filesize
92KB

Download
memory/2668-9-0x0000000003980000-0x0000000003997000-memory.dmp

Filesize
92KB

Download
memory/2804-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2804-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download