9b19b97767f2a225449863d95a69f7a57fc1633e5e37905caf872f191d2e035b

Analysis

max time kernel
123s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

951e2759ab87cb808018c6e4a895bacc_JaffaCakes118.exe
Size

452KB
MD5

951e2759ab87cb808018c6e4a895bacc
SHA1

7ea171e8536fb91629457624e7f20a668e96455e
SHA256

9b19b97767f2a225449863d95a69f7a57fc1633e5e37905caf872f191d2e035b
SHA512

3ddb3dd165bee38282e2957ad598478b58faec4c06b7021949a46c4cfd4164975ea30c268e058b82b8083596ff87eeebaa80611d5d5776db6bb374af3f0721f5
SSDEEP

6144:Z5s6LhYNAIXGtGc/jflgXI+k0cN0ueUABAI/+vWln/InOBe0vRHJCw9gKNck:Z5X4AIWtFblgXISUgAqgonwnOQyRHJ5F

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	951e2759ab87cb808018c6e4a895bacc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\951e2759ab87cb808018c6e4a895bacc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\951e2759ab87cb808018c6e4a895bacc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...