46ecb6ffd02997d9f9a98d32953f681b771f89f6e32c140f4cfec840b011a368

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89d9be667aee595685bedb9d5d5f20e2_JaffaCakes118.exe
Size

3.1MB
MD5

89d9be667aee595685bedb9d5d5f20e2
SHA1

184da360cdbde4497ec2c75c4d12e726806fa699
SHA256

46ecb6ffd02997d9f9a98d32953f681b771f89f6e32c140f4cfec840b011a368
SHA512

d706e4ea9c6496e88863a9f5385269e8ec2a0b6046dcf9856bf97f34ffab283999cf6ba653530109d9d366b9a244cbecb380da5f394e901168f5b0e49978a54b
SSDEEP

98304:s1CFLqvqc0A+ZbSZinjQY+5fvoq1J7b4gcSP6qP:s4FGqc0AOSgnp4t1JZi2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89d9be667aee595685bedb9d5d5f20e2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\89d9be667aee595685bedb9d5d5f20e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89d9be667aee595685bedb9d5d5f20e2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...