9ac0efb244415a8e686cf2146711fcddadb5ca0eb04dd1c6037045cba43eff0b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d3ca1c6c2b9f7b8f440e3aa52ff086_JaffaCakes118.exe
Size

704KB
MD5

04d3ca1c6c2b9f7b8f440e3aa52ff086
SHA1

9f58a6db8a5ac8ecf691dd98d05611e0dd3e1fd2
SHA256

9ac0efb244415a8e686cf2146711fcddadb5ca0eb04dd1c6037045cba43eff0b
SHA512

83f6ba112dcaa450e676359168793327a3219194c78c211ce7a332277be8751a963f8b845eee07d573069be0222f5ab941497929747ae1c1987e0cdc1df02a64
SSDEEP

12288:rPXhFFTXmRSgFRlFjahsFTzEmabWLQwQ5azzZel:zNTXmR/FRlFMsFqSLQwQ5afsl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04d3ca1c6c2b9f7b8f440e3aa52ff086_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1580	04d3ca1c6c2b9f7b8f440e3aa52ff086_JaffaCakes118.exe
1580	04d3ca1c6c2b9f7b8f440e3aa52ff086_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\04d3ca1c6c2b9f7b8f440e3aa52ff086_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04d3ca1c6c2b9f7b8f440e3aa52ff086_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download