149c8f1116b37e8e499475edd1f4f1db60e773df68e731fe4e1eeaa9b349a90e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b704b656ae8157a6d10f00881e24df59_JaffaCakes118.exe
Size

118KB
MD5

b704b656ae8157a6d10f00881e24df59
SHA1

9f1ad6d7cc186799b084da30fe9447503d13561a
SHA256

149c8f1116b37e8e499475edd1f4f1db60e773df68e731fe4e1eeaa9b349a90e
SHA512

ca727a55330f2fc4f427a8132ba458c8067a4d1f7eb0eabc46a1d9bcb8f27977a4fb88483402b5d80500a345b5ef8f8f9e44c45babf202220946c00da053f069
SSDEEP

1536:gmkLUFPsooHtVErrrWuYYUFPsooHtVErrrx6cms5C:c+PsoYtVErrrSJPsoYtVErrrYcc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b704b656ae8157a6d10f00881e24df59_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b704b656ae8157a6d10f00881e24df59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b704b656ae8157a6d10f00881e24df59_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x000000002F7C0000-0x000000002F8BB000-memory.dmp

Filesize
1004KB

Download
memory/3044-1-0x000000002F7C0000-0x000000002F8BB000-memory.dmp

Filesize
1004KB

Download