3144fd9392a8b33eb9a29f94432c21bfdf19b96a9273863fa68de5be917133d3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cfd347c232660e73e0d2c33ac75cdf16_JaffaCakes118.exe
Size

142KB
MD5

cfd347c232660e73e0d2c33ac75cdf16
SHA1

c87a0a1f302e3545ae045a26857b42eb5ac30405
SHA256

3144fd9392a8b33eb9a29f94432c21bfdf19b96a9273863fa68de5be917133d3
SHA512

b9d83fdff6cd1cd2d22dc5b1acc738e87dcd26afd728eb732fc390e4cebc6bc93f0619123574d1b60b74766e317efe27cbb04f0b36a47860472a45b800ac7d06
SSDEEP

3072:6vGxK+lJ0wDOtzYdEWGBBVAkPpPudx8Vj0PZeGgsy:6QnTSJYHeBVAkiKVj0PZeGgsy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfd347c232660e73e0d2c33ac75cdf16_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cfd347c232660e73e0d2c33ac75cdf16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfd347c232660e73e0d2c33ac75cdf16_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-0-0x0000000001D10000-0x0000000001E10000-memory.dmp

Filesize
1024KB

Download
memory/1868-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1868-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1868-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download