c03e5d09aa61dae4cda64c648d48cb79b76aa8ca9ea783017ef517a7a46e5b17

Analysis

max time kernel
132s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe
Size

228KB
MD5

de63d60aa21b2999571b29b4c83ed250
SHA1

f4fa5b76bc4c48fb8f93a3c7e9b76abcbd351b0b
SHA256

c03e5d09aa61dae4cda64c648d48cb79b76aa8ca9ea783017ef517a7a46e5b17
SHA512

6f7a97c9fcb866a47c53aa33e5f345e481e27e6bdf81e77be742775e663ca1e3bb5805ad01289909aada9a9f5057427674ba4a86b71844c802269c9bd4a221e8
SSDEEP

6144:+6JCT3oGg8kwzk9QfotMtq8rdAUk7kO8FZC9zU:+64UGgGzAYoKRrdnO8XCa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4064	de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe
4064	de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de63d60aa21b2999571b29b4c83ed250_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\list.txt

Filesize
23KB

MD5
d940a92cbf39db90e2623c2003f782d2

SHA1
44bdee39e9c2c94ec5a19b5508a962f95bc7cb09

SHA256
ad6df95ec18742bec5d2a923c07129d9e241e2b680453893045e74b65a21ee7f

SHA512
d4270215f21dac853758b6b2fb8ff73f5a15a32a8bcc6f26f7742c3a1d313500d2065270be827856e5fcf4c3e13c830c80ce164c504a3c3bdb13f9c21284d6ad

Download Submit