b732f21baf46bf8818ba12a2e1c31dd46b6d5be309323e62d4960481ae8c2c6b

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f9f834648933284d2725707f86c608b_JaffaCakes118.exe
Size

394KB
MD5

2f9f834648933284d2725707f86c608b
SHA1

dbca80b1d9fa35080d0617d3f042836f57a0658a
SHA256

b732f21baf46bf8818ba12a2e1c31dd46b6d5be309323e62d4960481ae8c2c6b
SHA512

79a7ce0b497363319c72275badc8cf8d31782251f9bcd4904a4f22351c470d610f8ab403e9f6614ddb769de8866c7f1109a94fcfb8b4265b2f414ca81ae47c7d
SSDEEP

6144:5ZuuObR8sVImcyYC5JOJSpHdPYfIB7eJmrCgIJV/8VytfANe0lt2bwI6gBT8DJwD:WV+mziu9PwI9eEeXV/WAUtFIsDerW0D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f9f834648933284d2725707f86c608b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3452	2f9f834648933284d2725707f86c608b_JaffaCakes118.exe
3452	2f9f834648933284d2725707f86c608b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2f9f834648933284d2725707f86c608b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f9f834648933284d2725707f86c608b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download