fabafdbf4d38c219fc1688643b693705dc42d3009f2d513f55babc213ee7a14a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe
Size

207KB
MD5

02f3fd55f99b5c4b04f4dd07daf36afd
SHA1

eaa3ee556ea9a473cc6fa94c731376e495e3ec96
SHA256

fabafdbf4d38c219fc1688643b693705dc42d3009f2d513f55babc213ee7a14a
SHA512

de4b73c088133bc96c7436de9c45683435493df1ec7039ea77a54cc69af463f1d920f7b6286ed3e85469e81402e2c765ff70ad02781cd09997605ff3d2c4ecfe
SSDEEP

3072:ZN4ri23A+VALjxQaca8a8P4K1vr5J3LQpPoVeeHfNPL:UrijvSa8a8P4KZdJ3CPzeHfNT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2012	02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2012	02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2012	02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe
2012	02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe
2012	02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe
2012	02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f3fd55f99b5c4b04f4dd07daf36afd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2012-4-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download