2f7e94e6614db0f2dc848f671cdef742ecd6bbcc9397e0ccb5a3a05235d33839

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac1b14f6b31a02ccf0fd335ef7e10b5a_JaffaCakes118.exe
Size

1013KB
MD5

ac1b14f6b31a02ccf0fd335ef7e10b5a
SHA1

31f17906b289281d549bdb44131bd3fbf46d5e5c
SHA256

2f7e94e6614db0f2dc848f671cdef742ecd6bbcc9397e0ccb5a3a05235d33839
SHA512

9ab74b9bce068b8a2d7cdd15529b32c8f96d49ea84a3e3738d5162d2836954599116357daed484052fa8fe4e500ba079ddc0bdfc198f856725fcb0f9a03eb235
SSDEEP

12288:E1cN2FRR1q+ELdtE3SZ9YCylo3C8+y3rD02Sv5mgGTu17deD9irhJl2BDk9+up:GFR++G184C8+ySvxZexirhJoBg9zp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac1b14f6b31a02ccf0fd335ef7e10b5a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ac1b14f6b31a02ccf0fd335ef7e10b5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac1b14f6b31a02ccf0fd335ef7e10b5a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2912-2-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download