b6679e510a5db1fb2a016a9cc6f8231be1cfee28ee579f0a4273bfb2c2610bc3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4e81ac4aaa3b902552a3f58e2355567_JaffaCakes118.exe
Size

124KB
MD5

b4e81ac4aaa3b902552a3f58e2355567
SHA1

eaa3b2c92d829e222138be082903d97675e22d5a
SHA256

b6679e510a5db1fb2a016a9cc6f8231be1cfee28ee579f0a4273bfb2c2610bc3
SHA512

da2f23e99cb656b955c7f84a2457977111f00b099d1ec0ae37cea890e741476dcc5349b722625d55a6610e8ab3ca057b1a917bc56a48281184264f1413d7a4db
SSDEEP

3072:ckRkDl5o10W04nPU1Mh0m1VhlK/ZQX0Cm:0gC4QMhHDTKBQX0T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4e81ac4aaa3b902552a3f58e2355567_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b4e81ac4aaa3b902552a3f58e2355567_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4e81ac4aaa3b902552a3f58e2355567_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download