e69d97098444c1269c3d1b971ca318aadc7a2bb183088dae48a87c4640180faf

Analysis

max time kernel
126s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad12cad2652a45d72b79c6c162692e73_JaffaCakes118.exe
Size

279KB
MD5

ad12cad2652a45d72b79c6c162692e73
SHA1

795e30799de549073d6f01724310469253f92cf9
SHA256

e69d97098444c1269c3d1b971ca318aadc7a2bb183088dae48a87c4640180faf
SHA512

44820fb99bdaa05e72426f79e3124a196edaca75693ccce7aefb2f5a2ca354b7d6bd7788260bf823e575a5d444a64b8ebfbd75afa079a000036b0ae003ed05ae
SSDEEP

6144:Kh67TmmEwjVjhc5jZHEI5FPyxjtgb0exy:KEnml2Vjhc5dtFaxBO0eU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad12cad2652a45d72b79c6c162692e73_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ad12cad2652a45d72b79c6c162692e73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad12cad2652a45d72b79c6c162692e73_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1812-0-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/1812-1-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download