ac633cf69e5a25843ff0584748f3351df6098afe830bd7b860007727dc9f029a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe
Size

297KB
MD5

eacf0d808b2b71ca047ae17ea4061847
SHA1

dda3276a57f457816eb3d2215d6d3bff8dd23dc7
SHA256

ac633cf69e5a25843ff0584748f3351df6098afe830bd7b860007727dc9f029a
SHA512

f285388ea526c7b06a86ecc6c7f77f3abc23aac69d0e9bb7bd6c3deb85d51f9003b126e131bc0f1eb0cb96b35e1cd55b36f4d2c258e5026c5042ed960c4c53d1
SSDEEP

3072:qpe7LPXFomWqLEnCYvcvIXRTy1hmUI0xlOcwJIvS3oGcFuG9hFoHk148GzMwfp3z:keXmvDx8hzNxl8JIvSiFxTO8GzM8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1984	eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-1-0x0000000000380000-0x00000000003CD000-memory.dmp

Filesize
308KB

Download
memory/1984-0-0x0000000000280000-0x00000000002C4000-memory.dmp

Filesize
272KB

Download
memory/1984-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1984-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download