a0c60aeb9e7a191810880073bef54a57d19cff6a1b5f1fe1a34c539ba29fe304

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10e94d7845a42feb017994a20223e271_JaffaCakes118.exe
Size

96KB
MD5

10e94d7845a42feb017994a20223e271
SHA1

1770561144f87dcbd8f4b01e4b5ff7f128627935
SHA256

a0c60aeb9e7a191810880073bef54a57d19cff6a1b5f1fe1a34c539ba29fe304
SHA512

7f5218574c1a836e514b207f00bf27ca13d95216e8c6315c627b84bd94219b11be05857fe703ace42f26dc451946e6befe62d7087fbad39fdb2db65a9e2f3af7
SSDEEP

1536:8YrUVOWQa+NWAKxFN1Gt5Ao6r3PZox01zIwlMqt3PCpOmxageQSydNRpbqM2LGTt:jUQ8zIwlMqt3PSCQSObD2Lu9xn5OO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10e94d7845a42feb017994a20223e271_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2968	10e94d7845a42feb017994a20223e271_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\10e94d7845a42feb017994a20223e271_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10e94d7845a42feb017994a20223e271_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...