14b71b3d4d32d1e2051187c5434cc586a83c3399736fed163106c1d1c613b8c7

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc43c3d535b3483126ea2a09d8a0941e_JaffaCakes118.exe
Size

421KB
MD5

bc43c3d535b3483126ea2a09d8a0941e
SHA1

1ee7f5ea5ce73a1af6092a6b6d7bac405fe0263e
SHA256

14b71b3d4d32d1e2051187c5434cc586a83c3399736fed163106c1d1c613b8c7
SHA512

15cc9f524c94b3035ce1827d457fc86549b49876f49f7beed47342e99d5a8fe2f905a859b2a3ab6e4066262fc0de6422483d741712dc605065887d0776ff9fe4
SSDEEP

6144:OGBrbnBT7mbn776Zk/qpljz2JNPc8bsd4uZExfJ66DgkGqUpAQQy7l:/Br7BT7k0HuJtxsdgJTD92bVZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc43c3d535b3483126ea2a09d8a0941e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bc43c3d535b3483126ea2a09d8a0941e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc43c3d535b3483126ea2a09d8a0941e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2560-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2560-1-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download