48ea6db4c45b0f29fc05a8265796badc031551a47450c68441e8703f0326eea6

Analysis

max time kernel
94s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2024, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f726a1951d1b4d672ca3b0bdcd5ff98d_JaffaCakes118.exe
Size

24KB
MD5

f726a1951d1b4d672ca3b0bdcd5ff98d
SHA1

87af5feddd536b3445481551e4548a663309df03
SHA256

48ea6db4c45b0f29fc05a8265796badc031551a47450c68441e8703f0326eea6
SHA512

6a172aa7a5791e6a7cd38ec5753c280c234e74fc2a36c4d5295857e4b2832cc98f664fb89ec7bfcc0e95f1be36e18900a69debca9ae6e23138527666bff39f6a
SSDEEP

192:/TJ8UMgP4xlMr/QKY9BFZhbtRFRjhB9yxEj8:/T7Mg4lMr/QKY9BFZttRFRb9ye

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f726a1951d1b4d672ca3b0bdcd5ff98d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	f726a1951d1b4d672ca3b0bdcd5ff98d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f726a1951d1b4d672ca3b0bdcd5ff98d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f726a1951d1b4d672ca3b0bdcd5ff98d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...