a8a1c61676a7f38e20c5b2ab25ba79f303d56c1cf1819fb00d685f39935ff2e6

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

524552f5c303925b9e92c30bc1f85af0_JaffaCakes118.exe
Size

791KB
MD5

524552f5c303925b9e92c30bc1f85af0
SHA1

48859a7df2ff6e2b362f0923674c1cfd26911840
SHA256

a8a1c61676a7f38e20c5b2ab25ba79f303d56c1cf1819fb00d685f39935ff2e6
SHA512

542b0417a82d4eab887b9c311eaea4434c9e0920708a29dbb90337214305821d5c829b30db9aecc7deaab63b434c252ca63dee2a0a9903fe0c30d99e1318a584
SSDEEP

24576:nvWXzhXGhFkxywXctuhjFSm2j/VeZxTNPoK:vWAhFksmjFbcITNPoK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	524552f5c303925b9e92c30bc1f85af0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	524552f5c303925b9e92c30bc1f85af0_JaffaCakes118.exe
4912	524552f5c303925b9e92c30bc1f85af0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\524552f5c303925b9e92c30bc1f85af0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\524552f5c303925b9e92c30bc1f85af0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4912-0-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4912-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download