ec1cb505b8787ce2b39383c4f9eedb489cad239502eca9d3e9cb952cc76d9ce3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1ea0ab503dd8348e59167e6bac25301_JaffaCakes118.exe
Size

275KB
MD5

e1ea0ab503dd8348e59167e6bac25301
SHA1

7583a86be06aa98fe9c70efcd3af10753d7a7744
SHA256

ec1cb505b8787ce2b39383c4f9eedb489cad239502eca9d3e9cb952cc76d9ce3
SHA512

351e645c3a82fab91d188d3d47bb7f79ed7a7dddd40cd024d7442406ca6003a27457557a35d1fc5df5974cd36035fbf52142505ae69e670b1945093b431ed648
SSDEEP

6144:TBKHYmz6mq2pmHmFV2YjnWuwqzeRhvaw48:04m5bpnL2KnEqCRhva8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1ea0ab503dd8348e59167e6bac25301_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e1ea0ab503dd8348e59167e6bac25301_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1ea0ab503dd8348e59167e6bac25301_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/2052-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2052-2-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download