d84a5c3514c3cc94dc08d98b9b7ad4578fa5d8896b3cb63ead68ae511b8cf13e

Analysis

max time kernel
142s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

743a0ba8915853b5dc3b0a0f3cdd8598_JaffaCakes118.exe
Size

20.0MB
MD5

743a0ba8915853b5dc3b0a0f3cdd8598
SHA1

5893605de0dbcedb9ed8b49fc2c4a902e0cf3b67
SHA256

d84a5c3514c3cc94dc08d98b9b7ad4578fa5d8896b3cb63ead68ae511b8cf13e
SHA512

e5ec2bebd5ec3243cb53dfdd128a8990c8ba7f23d8ed66e2aeed5062d8094c67446751202bb9efd64d486b4b92827d3e617adbee02eb26c751e2eaca89944140
SSDEEP

393216:4ZZy7ZHHAl2vqjPdwNBJQ9LbfbjZCxJbgmAjk/bj503M:KcHmEsfwNtDjcM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	743a0ba8915853b5dc3b0a0f3cdd8598_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\743a0ba8915853b5dc3b0a0f3cdd8598_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\743a0ba8915853b5dc3b0a0f3cdd8598_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-0-0x0000000000B30000-0x0000000000CF4000-memory.dmp

Filesize
1.8MB

Download
memory/2864-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2864-2-0x0000000000400000-0x000000000077A000-memory.dmp

Filesize
3.5MB

Download
memory/2864-3-0x0000000000400000-0x000000000077A000-memory.dmp

Filesize
3.5MB

Download
memory/2864-4-0x0000000000400000-0x000000000077A000-memory.dmp

Filesize
3.5MB

Download
memory/2864-5-0x0000000000400000-0x000000000077A000-memory.dmp

Filesize
3.5MB

Download
memory/2864-6-0x0000000000400000-0x000000000077A000-memory.dmp

Filesize
3.5MB

Download
memory/2864-7-0x0000000000400000-0x000000000077A000-memory.dmp

Filesize
3.5MB

Download
memory/2864-9-0x0000000000B30000-0x0000000000CF4000-memory.dmp

Filesize
1.8MB

Download