b8d92696118757e3b709ef1ca4e00e979f47ae2894a8a9954b3f0ebfa78624e5

Analysis

max time kernel
140s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 05:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3895a3516bf6fc075bc3c7c3d6498561_JaffaCakes118.exe
Size

496KB
MD5

3895a3516bf6fc075bc3c7c3d6498561
SHA1

c347a17ebdf599224890ac99a81acfa551652e8c
SHA256

b8d92696118757e3b709ef1ca4e00e979f47ae2894a8a9954b3f0ebfa78624e5
SHA512

1804ac2323549581e474bbf6f8a52ee272ddab8a2d4b300660a1788946bed5a5a72fd1a7a1ab30f8857de3db51ca4141805dd33b9dcb1e18f51185e40bbb5f2e
SSDEEP

12288:v5O3JJJJJJJJJJJJJJuJJJJJJpn4x6gFH4iboi8R+inDR1Svd1oQyJ+Wr:vI3JJJJJJJJJJJJJJuJJJJJJ+xrFH4Vr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3895a3516bf6fc075bc3c7c3d6498561_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4916	3895a3516bf6fc075bc3c7c3d6498561_JaffaCakes118.exe
4916	3895a3516bf6fc075bc3c7c3d6498561_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3895a3516bf6fc075bc3c7c3d6498561_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3895a3516bf6fc075bc3c7c3d6498561_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4916-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download