338f9ef05a09dcb38a235806ee33c642719f7ad0a0a8a0333ae48752ea32c9e7

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05ff6372a0c9926a666e5fe7f52cfc2d_JaffaCakes118.exe
Size

180KB
MD5

05ff6372a0c9926a666e5fe7f52cfc2d
SHA1

2c58b1699f1793a8cbcae26b0f1dee3af5ec7a21
SHA256

338f9ef05a09dcb38a235806ee33c642719f7ad0a0a8a0333ae48752ea32c9e7
SHA512

7aa4500dfe0d877669a8c362a13cdb15ab5e6ba4ae1281b3f2ad8f002c8cb6337ed040230e6e8fcbc456cf9e5ddbe015e06d3cdba4ffefb295469bd25e2e6fc2
SSDEEP

3072:d2elpU9jsF7qAHQhPKMLZAaBIIf1/x1UEMUFD7OoQDuEPZ5:Iy5IycZA4IIfB//Ez

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05ff6372a0c9926a666e5fe7f52cfc2d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\05ff6372a0c9926a666e5fe7f52cfc2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05ff6372a0c9926a666e5fe7f52cfc2d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...