72dd8541d94d144e7fed5ac4ee10f2fdeae133eb5889b2339ffb16f124a5483f

Analysis

max time kernel
133s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84cb14523d7895eb6182aa58096ee35d_JaffaCakes118.exe
Size

30KB
MD5

84cb14523d7895eb6182aa58096ee35d
SHA1

73958bf703a376c46abd1d9c313399ebc4fc85b1
SHA256

72dd8541d94d144e7fed5ac4ee10f2fdeae133eb5889b2339ffb16f124a5483f
SHA512

b565100d2d534a9599170dfe1ea1ab5b02daaf81eec5b81f634345c69fc6aa85d847b43f8bf96e0152919aac0ef6590a9e2f31724cd4105635e5b63ee90f22ff
SSDEEP

768:LQL/BFn1AgFpExL06hlnRMPu1e7Nv62n3gYRNe9BD:LQLz1AgFpExGZ7NeYRNevD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84cb14523d7895eb6182aa58096ee35d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\84cb14523d7895eb6182aa58096ee35d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84cb14523d7895eb6182aa58096ee35d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install_config.tmp

Filesize
918B

MD5
a1d29738a8e5ea74f0df1bf1b1bb5195

SHA1
fe55048168afd4224d8c2045961d33572681285f

SHA256
9e3101ab468271d6c997bf77e5246dbffb02046112887746762a8795573a7976

SHA512
bc9a3e38588e870e638719e7c83f91333250dc0707fc7b62abc9f55daba17bd49d808d17c17b401d2d407f84b6fde7795f87383314cbba14e09a6958884a440b

Download Submit
memory/2568-4-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2568-3-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2568-22-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2568-21-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download