ac85657520ef222b500b156fe57dc7713a91ba594f7c7f2ac34341725a16e30b

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

08b572870b5e8fba034a5a45ab162e85_JaffaCakes118.exe
Size

196KB
MD5

08b572870b5e8fba034a5a45ab162e85
SHA1

99c81f295bcadab2978901461287a3705243666e
SHA256

ac85657520ef222b500b156fe57dc7713a91ba594f7c7f2ac34341725a16e30b
SHA512

a29d656f0314100c17136a14958f72ff0429aa7a56ff1ce2ff1b864ae5db2094da1277eab149b54a46715a24aefb44a71286d4da9a959a74cdbd8529595a3b3a
SSDEEP

3072:03IXrV8JHdcVA7lOxLK2DHMBRwkovd5Mv4+CUgUyTidOym1SwmmlE/Z/b3UnKF:CcO9Gxu2LACkovd5qrg1TidOix/Z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08b572870b5e8fba034a5a45ab162e85_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	08b572870b5e8fba034a5a45ab162e85_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\08b572870b5e8fba034a5a45ab162e85_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08b572870b5e8fba034a5a45ab162e85_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SetupTool.ini

Filesize
2KB

MD5
7e470bd4ed65392925b1fa939a066598

SHA1
cb248a1423826976b66536c2c4251da7d46308e3

SHA256
36d511e82ade43ec2480657067bb4acd6983bc1d4da7b2a9ab761e2a2c6d3919

SHA512
59ee5c3358e9f8ccd42a96566fc62a5914d79c0022a1740e645654ced4d3ddc470544ab2c5659e88deb8a9a213466f8a957a68618e81458d5e2f463385461be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\SetupTool.ini

Filesize
2KB

MD5
213f46134d4262f52f0928ec2d987242

SHA1
a6e94de18755b4afcfb9e782d9cc9b112b60a13b

SHA256
fad8278282eeba2f3ea5b411d79ce98fb3ba12fb7c63c6d41691f9ab5364ff8f

SHA512
899f3e70c1391bad7c4770688d037166fbe63669d5083678c72186474af34a91d057f2916836330240abed21db57d6824db9dafd0fa7bc7ac10aeeee03c2b0f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\SetupTool.ini

Filesize
1KB

MD5
0d24417cddaafdbbd1b63f0baadf688a

SHA1
b4b5c3d8eef109c5fc1a0c777fe48bcd126e73be

SHA256
0501fe24877ce0eb3aa65909598aab6b0763e93067c70d493eff1454467c4b54

SHA512
a28d1b80b7c9c343a8d359dfd7e97038c2b49dff7300bd56fcaaaa224c458f91f4c155f625df4d702e05058fa828d95fb666decf4c51842753440c72acf85436

Download Submit
C:\Users\Admin\AppData\Local\Temp\SetupTool.ini

Filesize
1KB

MD5
d03eeee5de307c98533315ef4df61923

SHA1
41f5518983632c501409e066dab25fb0247482d9

SHA256
9f54e99963ebd7fc0e73db41c6082764a69fb9689495d3286bc267699f1e63cf

SHA512
7e181afa3a20746b7f3c6006c095608073733abbfa377491c12d18bf255eb888d6f13977dc5f579d516bcfd5318357679c392fc08126b2f208dbe08b3d2754a7

Download Submit