20232da4de4f34eab9d24748c281ef2e7a91e5cd93bc6247c1b67a49c960b4a6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fccd5de59795ca512f5cec67309c24e7_JaffaCakes118.exe
Size

16KB
MD5

fccd5de59795ca512f5cec67309c24e7
SHA1

73a60efd9aa1658a3199e8fe71ded334d0f130d1
SHA256

20232da4de4f34eab9d24748c281ef2e7a91e5cd93bc6247c1b67a49c960b4a6
SHA512

7d612acf0f0d0d342b4d8c0a93c99e7c5160924ae0da68f659b10f4ea84e2a8b53d80a261bba15e59d8e25e9c96aa732db7e1e6619fc763b2dcc183acd6c18ba
SSDEEP

96:2omeY+y2a+6Ug6ClEG/Bpjwjo3tosEW4NgUnoHeS2Er2:RY+y2a1U3o/jwjo3tosEWBHoEr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fccd5de59795ca512f5cec67309c24e7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2080	fccd5de59795ca512f5cec67309c24e7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fccd5de59795ca512f5cec67309c24e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fccd5de59795ca512f5cec67309c24e7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...