70d6c8648c5578f98a6080bbc66b8eafdb7ba9b650d7c405af9ff11780146af7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81cc585c6dda44cda2e9ef91c238b8ff_JaffaCakes118.exe
Size

347KB
MD5

81cc585c6dda44cda2e9ef91c238b8ff
SHA1

be98eeb46e61671e06031cea140661cd3d4db553
SHA256

70d6c8648c5578f98a6080bbc66b8eafdb7ba9b650d7c405af9ff11780146af7
SHA512

d2b1cc14a6b8e7350b564dc09f0bac1375d27f9c6e6cac235c3985123e084044b451f9475f48c20cfd78cb7b13ddcf3c2a200f985831489c1bc95556bb02fd54
SSDEEP

6144:/efdDoDLhnowxc2NDvJQT90jp0jQ9p6c789JZfkoXfNIK+i9SPVsMXy:WRoDLvO2NDzzpd8hfxNIK+i9Vl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81cc585c6dda44cda2e9ef91c238b8ff_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	81cc585c6dda44cda2e9ef91c238b8ff_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\81cc585c6dda44cda2e9ef91c238b8ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81cc585c6dda44cda2e9ef91c238b8ff_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...