9e6481f45801a2504e53d62d0959a8584a99b8bd9f931a398b3764b3de9a8699

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe
Size

432KB
MD5

0e9b681eb5ea11c3224aa971f1f991c5
SHA1

021edbfc3aa1466a3bf715caf4799f9e736b89ec
SHA256

9e6481f45801a2504e53d62d0959a8584a99b8bd9f931a398b3764b3de9a8699
SHA512

2ea600d552eba2176c4319482b85555e477d6f483e80986810b98c882dc7e84a5f7731f46b4b45d5c42dd9a2656e39b34069bf8a8b221f957c544c817a19d3f4
SSDEEP

12288:tsiw5U9lr5ZwyO0dYA51ufIwudyjDyvkAtDT:iiw5cr5Zw4dY6rwoyjDyvH3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3916	JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e9b681eb5ea11c3224aa971f1f991c5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3916-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3916-8-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-19-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-18-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-20-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3916-17-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-16-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-15-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-14-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-13-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-12-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-11-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-10-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-9-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-7-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-6-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-2-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-1-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3916-5-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-3-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3916-23-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download