2f24a45be3da6a818cf18cee43ecb03e25ddce3eef7c8f308e1a5017479be06a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a96e1dc46ef4af5a0ae065d47b18f965_JaffaCakes118.exe
Size

634KB
MD5

a96e1dc46ef4af5a0ae065d47b18f965
SHA1

ce68a07727c1094e212051b096bbe69a620c5465
SHA256

2f24a45be3da6a818cf18cee43ecb03e25ddce3eef7c8f308e1a5017479be06a
SHA512

c5845c2d2e5317593e6e6bedcf3ded0c156bc11d7485b9ab3740a0b1d7229460193077c54d8a9eb0a2ddbda42799cf90a0859ff6647b29268eaf47990712c364
SSDEEP

12288:F6Z9WafZRIAHFcfUrG19N05F3Z4mxxR17Hk7TgP5UP3Uu:iBNmMrk9N05QmXQgCPku

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a96e1dc46ef4af5a0ae065d47b18f965_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a96e1dc46ef4af5a0ae065d47b18f965_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a96e1dc46ef4af5a0ae065d47b18f965_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-0-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2356-1-0x00000000003A0000-0x00000000003F4000-memory.dmp

Filesize
336KB

Download
memory/2356-3-0x00000000003A0000-0x00000000003F4000-memory.dmp

Filesize
336KB

Download
memory/2356-2-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download