ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecb6e0b8c1c969fb81be1b5d52ea4bab_JaffaCakes118.exe
Size

708KB
MD5

ecb6e0b8c1c969fb81be1b5d52ea4bab
SHA1

aa7d5a7a84f7a2b24d5177bfc147561964d0a250
SHA256

ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44
SHA512

4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48
SSDEEP

12288:NGcpdQGrhJFun+3L04NtfzaAixx2L6sqyHdUPsjIPF81DLAIM:ND2Grg+I4Ntfzay3UMiFay

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecb6e0b8c1c969fb81be1b5d52ea4bab_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3308	ecb6e0b8c1c969fb81be1b5d52ea4bab_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ecb6e0b8c1c969fb81be1b5d52ea4bab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecb6e0b8c1c969fb81be1b5d52ea4bab_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3308-2-0x00000000022D0000-0x00000000022D7000-memory.dmp

Filesize
28KB

Download