58e37a70da21cc457f961cd6fd5aac89ab7175dbbcba56e5a05e410d900bc7aa

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82e5d8a4c68c8354754ba78d6d1dccae_JaffaCakes118.exe
Size

23KB
MD5

82e5d8a4c68c8354754ba78d6d1dccae
SHA1

3cbcceb57c484d0b37063b36ccb6ecede9628d8a
SHA256

58e37a70da21cc457f961cd6fd5aac89ab7175dbbcba56e5a05e410d900bc7aa
SHA512

58a2757d1606e674410eb2b188b3cd989a921c3e6d9c703d00b545ce76767bf3428072b91539641f160e408243a3a0c8dc8bd3fb30728e81801632f2277c2528
SSDEEP

384:Kfk0oEO8xZQylDG2i7cO8Lk24jXPlkcya3XEWcO0QdWCF:v079xZQaGpQ2XP3H

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82e5d8a4c68c8354754ba78d6d1dccae_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\82e5d8a4c68c8354754ba78d6d1dccae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82e5d8a4c68c8354754ba78d6d1dccae_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-0-0x0000000073D0E000-0x0000000073D0F000-memory.dmp

Filesize
4KB

Download
memory/2288-1-0x0000000000920000-0x000000000092E000-memory.dmp

Filesize
56KB

Download
memory/2288-2-0x0000000073D00000-0x00000000743EE000-memory.dmp

Filesize
6.9MB

Download
memory/2288-3-0x0000000073D0E000-0x0000000073D0F000-memory.dmp

Filesize
4KB

Download
memory/2288-4-0x0000000073D00000-0x00000000743EE000-memory.dmp

Filesize
6.9MB

Download