153c95fd5bd6fc7cf3d4a3bde7f4e89fa1c3e3cd4ddff3671854b18c6f1bc0ba

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a76645b57bc43c8c112db61eb8d33b3e_JaffaCakes118.exe
Size

480KB
MD5

a76645b57bc43c8c112db61eb8d33b3e
SHA1

9559a6db413f67bf1110e58abfb14486d2b398d2
SHA256

153c95fd5bd6fc7cf3d4a3bde7f4e89fa1c3e3cd4ddff3671854b18c6f1bc0ba
SHA512

957dc653fce7233ddba8cbe68ddfa0d9d2cd3ed870b6fb11bc1475849ea428cd11fe8011b570fef86e00f1a1b433e2bd34aca27b7e61e56cd7452d9bdcbec865
SSDEEP

12288:68ki8a7cm2zqKQ8cs0ARbUAkqo36U0/2D4GxE0kS:Cixpxqof0/2D4b0k

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76645b57bc43c8c112db61eb8d33b3e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a76645b57bc43c8c112db61eb8d33b3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a76645b57bc43c8c112db61eb8d33b3e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-4-0x0000000001D30000-0x0000000001E30000-memory.dmp

Filesize
1024KB

Download