a4236cd6ce85bbfe09b9ea81a66dd7f2386be646acc6e7b778d97f16e8d526f8

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbdb43021f3d66a79ad45addf85543bd_JaffaCakes118.exe
Size

209KB
MD5

dbdb43021f3d66a79ad45addf85543bd
SHA1

08df2750ff1c3cf71cb07500b78c3c3bd7644707
SHA256

a4236cd6ce85bbfe09b9ea81a66dd7f2386be646acc6e7b778d97f16e8d526f8
SHA512

5affaeb501b3809fea1386e6090e86ca24cf6145b312ce30d5e5b312d7bb15b071503d96e89bc0cd5fb3e00c15cf92e079c38c9aebaf1db3f51456f1424a2d5b
SSDEEP

6144:RUHK7S/CG9RV3TIkgE6pBQCOedpoOiimbTDKRunmTN5d:XZG9jTIy6pBtxEOWPDKRunm5z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbdb43021f3d66a79ad45addf85543bd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dbdb43021f3d66a79ad45addf85543bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbdb43021f3d66a79ad45addf85543bd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-2-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2972-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2972-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download