2cfc5554ddb8b44629fd62a083f11db20cccb0cd539b8d317d8476e5353ca2e9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b17b569d250367651b124f27755eb336_JaffaCakes118.exe
Size

387KB
MD5

b17b569d250367651b124f27755eb336
SHA1

4e65cbcbc1380f5f90d6eb9aece951c682fa67a7
SHA256

2cfc5554ddb8b44629fd62a083f11db20cccb0cd539b8d317d8476e5353ca2e9
SHA512

0ab588d8d9939b51f27b2769a0b1420e97023fd0389e565f2c48b464dec784f6a652743933ce1d2127d02d2dd36b49e90dd3e3bf44b53282b53a3cbfbd43fbc7
SSDEEP

12288:pXFxSd+B9rvA4LOIxAB2ckIrG4f9GvXGZ:vx0IxjcfGg9GfGZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b17b569d250367651b124f27755eb336_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b17b569d250367651b124f27755eb336_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b17b569d250367651b124f27755eb336_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2372-2-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download