c0aac678fffe20e3cc4b698943ad7a35f716b5140aefce9332f24fe0b6218e2a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab8434813494e5b1bb633be79365874_JaffaCakes118.exe
Size

716KB
MD5

eab8434813494e5b1bb633be79365874
SHA1

a69f775122cf10f555a11371584e5ce8953d893b
SHA256

c0aac678fffe20e3cc4b698943ad7a35f716b5140aefce9332f24fe0b6218e2a
SHA512

6028711a8dda48db98ff67ab1fdf84d2a00dd3b77011660ffd8f46ce47ef562f80a92b887c6e292fe75870f91a9ad7bffe971d88441fd8051c11ab5432523dc4
SSDEEP

12288:UXuDT8+rNVj0NbYTuJsZZRB2phVlQDao1hk1E9OPUcnAaBlwXewGar:UXuDT8+ZVANaw4ZrUA//WPXnCew

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab8434813494e5b1bb633be79365874_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eab8434813494e5b1bb633be79365874_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eab8434813494e5b1bb633be79365874_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...