ade0bb49141a2c91c286f5fc72c08be7380e02835eb520c48f4f88df573562ce

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9e50b291447fefbfd6ce4ecd71c3eea_JaffaCakes118.exe
Size

644KB
MD5

e9e50b291447fefbfd6ce4ecd71c3eea
SHA1

0607a9c7d959e6df3eca955dee9317178ba8d450
SHA256

ade0bb49141a2c91c286f5fc72c08be7380e02835eb520c48f4f88df573562ce
SHA512

c2c6efeb011263c7edd19dc26127dc137d92654787d90a74d1b8e643d5d18d68a3207694c2226c7f9b0cefd7c1cf327919869c195c56de665f4ba4a311bc45cf
SSDEEP

12288:2d2nnUajxLnJKC7ezwzAZ3Txt2BuvORpp9VH8:2GUEnJKCatnQEORtVH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9e50b291447fefbfd6ce4ecd71c3eea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e9e50b291447fefbfd6ce4ecd71c3eea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9e50b291447fefbfd6ce4ecd71c3eea_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2380-1-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download