3a2f3c54be02bac607a869fa05c51d52331b1676beb3a59f0968822b8bef2fe3

Analysis

max time kernel
3s
max time network
0s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8a8ddee5e576520c19eb6fe4974a2e56.exe
Size

96KB
MD5

8a8ddee5e576520c19eb6fe4974a2e56
SHA1

491adcbfbd0f25b194e8be6dee575f3bdf8b16e4
SHA256

3a2f3c54be02bac607a869fa05c51d52331b1676beb3a59f0968822b8bef2fe3
SHA512

7f2e53be2659e15c440938f371eba8326e1477755747cb26f1c69f9eb45cbdfbed2379a2a2bbb03f3fa886f5daddd89c12098772e49809e9c110a4306c5fc3e9
SSDEEP

1536:34hBHmf6cOahdkGulSc16l6u+NMMl/KlYv1T4hThF/NIjnZbf:Cgh6lu88FF/Cnxf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8a8ddee5e576520c19eb6fe4974a2e56.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2700	JaffaCakes118_8a8ddee5e576520c19eb6fe4974a2e56.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a8ddee5e576520c19eb6fe4974a2e56.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a8ddee5e576520c19eb6fe4974a2e56.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2700
- C:\Users\Admin\rpdoon.exe
  "C:\Users\Admin\rpdoon.exe"
  2⤵
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\rpdoon.exe

Filesize
96KB

MD5
b1ffe0b5c9866cedefe2cca2ce2ba7bb

SHA1
60b3648e4efa7fa509f4dea0b05be0925411a5c3

SHA256
6109ac11987a3fda6b70c4ca6e46ac0c6e87d56d9b66cb13054728360dd74832

SHA512
4f8fa835772194b5a387860d59b4ae228cf68ff44a631ef6cfcb5ece34c749b2184cfffce04790d4baf0d743198215851b6cf4859a356594dcd141488439cdcc

Download Submit