00d7b4601f0cca7bb68acd744c789c19035c4500555d9b417607fe0e242eded8

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e174e4fe1fd9a541fd42948a15bcc1ab_JaffaCakes118.exe
Size

27KB
MD5

e174e4fe1fd9a541fd42948a15bcc1ab
SHA1

7c22210d9fc94d151af56d63980245f8d8748227
SHA256

00d7b4601f0cca7bb68acd744c789c19035c4500555d9b417607fe0e242eded8
SHA512

1404ee75710f807b00055c96fdbfb5cd545cb5d1773f226968c26ace8a95e0e0c1ea7b0b415f49fa0760c8e138fe5b65b19fcd2be6271eddc2a3082affcd6969
SSDEEP

384:/TtR20IPxDbY99bMus4Q7KKQqsLgKDgKDfKDqz0Nt9nifp:/hR20INbgA4Q7KK6tz0Nt9niR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e174e4fe1fd9a541fd42948a15bcc1ab_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e174e4fe1fd9a541fd42948a15bcc1ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e174e4fe1fd9a541fd42948a15bcc1ab_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3032-3-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/3032-2-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/3032-1-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/3032-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download