19fe20951f9b0454ef72cde7f5f71a113313d82fc103dc5ff9464b3906a473bb

Analysis

max time kernel
26s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa9ab26940f099fc8168d72c3e9afbea_JaffaCakes118.exe
Size

238KB
MD5

aa9ab26940f099fc8168d72c3e9afbea
SHA1

d1f9cf79cba33175151b3dfae20c455bed4a7235
SHA256

19fe20951f9b0454ef72cde7f5f71a113313d82fc103dc5ff9464b3906a473bb
SHA512

dc79b7aa4119120c0ad076c9aea6847975fac2c3afe76928d086199ee7434eced9f5c9b0e46e1311f55018ff81e264fa95a55774674befa798e2fd1801d0e786
SSDEEP

6144:QDR4e9BKWoiU9Acc/0pYv0Nw3K14JMNI7BP4mB:W9wp9Z360914GIJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa9ab26940f099fc8168d72c3e9afbea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa9ab26940f099fc8168d72c3e9afbea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa9ab26940f099fc8168d72c3e9afbea_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2488-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2488-2-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2488-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download