e569c5d32a08bbc26127dd1b6deb5c4182380c85d3784af36054c876715af30e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe
Size

396KB
MD5

533cbbe966f18725d59fc008d74c705d
SHA1

b36c6959dff28e8d2135cc5c59d2f467efd3162b
SHA256

e569c5d32a08bbc26127dd1b6deb5c4182380c85d3784af36054c876715af30e
SHA512

7ca32de0b3c0a07cbe6c9f98a6b09af8d8d499c48e9fbccbf3eed4f89395d98e5d3028de067ea710cc1279cd38576bcf09bcb2f4535ad2a93af6c13ca5b4d3a4
SSDEEP

6144:vjiNGW8heIE0cTaz2t75aaWYcdY82pSvHppfSzC6efOChghfUwBxPXO3dkKdvzuD:vOYW8hHTcTLgvKNpShphEXTeN7zuQG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2212	533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe
2212	533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\533cbbe966f18725d59fc008d74c705d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads