257b6efc63e0896d00638a9f08ecb4b7f7c3a8424c9eda16053ca9ff3656d968

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af74d4094f1084cd0458941c1f812890_JaffaCakes118.exe
Size

128KB
MD5

af74d4094f1084cd0458941c1f812890
SHA1

cada28007246b7f21a64fe0c26f2737dc5108fd9
SHA256

257b6efc63e0896d00638a9f08ecb4b7f7c3a8424c9eda16053ca9ff3656d968
SHA512

1c14756a119617fe00784609306402129f191da6f94e196b6d8e0886eee38d39e6b450c7ad2d12be2ca214d471b1579b3d69a844ff2670d84251038ead3924ea
SSDEEP

3072:ptMWoHmGJ5mQ4DFy3mE5iJleCJMrLiGAMN:bMWq54kWE5iJlmrLQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af74d4094f1084cd0458941c1f812890_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\af74d4094f1084cd0458941c1f812890_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\af74d4094f1084cd0458941c1f812890_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x00000000740C1000-0x00000000740C2000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2116-2-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2116-3-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download
memory/2116-4-0x00000000740C0000-0x000000007466B000-memory.dmp

Filesize
5.7MB

Download