8661f296c1b1479948b7e7dd0b94c60b57d3b4fc51708f4ec7fb8d934401298a

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2590dd065920768a2979965365465ea_JaffaCakes118.exe
Size

147KB
MD5

e2590dd065920768a2979965365465ea
SHA1

f66a48fe104913caa4fa4c499e0d07dedf866928
SHA256

8661f296c1b1479948b7e7dd0b94c60b57d3b4fc51708f4ec7fb8d934401298a
SHA512

483c69ea4840676c0d23151b68a762718d38827d62ab0e2ed24d0aaa606e384e54bab39acf89abc46b8b49d2c7b5bd631e5956aebf8b98e67adfff7af16083ca
SSDEEP

3072:qtp9XnUh9sSofOWGd2Mm+H8UgnzihYRMU1S+8:mphJgd2MmU8UgzigMCt8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2590dd065920768a2979965365465ea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e2590dd065920768a2979965365465ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2590dd065920768a2979965365465ea_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2348-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download