Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40db96226414213b680f026d0025e3aa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40db96226414213b680f026d0025e3aa.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40db96226414213b680f026d0025e3aa.exe
-
Size
323KB
-
MD5
40db96226414213b680f026d0025e3aa
-
SHA1
ade156e1d0f53e2ab9f71c1ed44f921962dc999e
-
SHA256
f65815d6aa63a7b094b3c432a121eb1bf5dceff446050ab2a44d4724ea5745fd
-
SHA512
a16760433b25fa4f94b646ad0009cdbb2307c78496091c95671a98ffcbaeaadb368b4d8847b18a27177d67e1f09aaca8bdf5bea3147a91ce7d5b2d93a2bcb423
-
SSDEEP
6144:G2cHOj13qad4u5mNubNqT3p9fqAmTYlyLHAmT8yAErgOHTIaNVc9u0ptFIoqk:G9K3qvuPgDSAJl8A5uNHTIaNVcA0pbEk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_40db96226414213b680f026d0025e3aa.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main JaffaCakes118_40db96226414213b680f026d0025e3aa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2492 JaffaCakes118_40db96226414213b680f026d0025e3aa.exe 2492 JaffaCakes118_40db96226414213b680f026d0025e3aa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40db96226414213b680f026d0025e3aa.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40db96226414213b680f026d0025e3aa.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492