ad03261ac3df4ca78fc274af7f1f1ca12ecff16ea0141f837ab8b529706cebdd

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06212c852fa3bf137fb7d81041c08594_JaffaCakes118.exe
Size

293KB
MD5

06212c852fa3bf137fb7d81041c08594
SHA1

e2c4334c3b9c5a7d9326a8faf86c78d281ad7dd8
SHA256

ad03261ac3df4ca78fc274af7f1f1ca12ecff16ea0141f837ab8b529706cebdd
SHA512

b8287814311e00e8a1ba89fe4fb74cc258ea023e683c5c80c5ae566afc9fb65feab031e546b4fded5d6d6f2a966bc103ad968e17753c28dfdf62f7b9df6dfb57
SSDEEP

6144:eYHmhlha8iugorDUgWo2Kyhyyyyy2lLtdF2Uv5bvV:VHwYbub32Xv/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06212c852fa3bf137fb7d81041c08594_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\06212c852fa3bf137fb7d81041c08594_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06212c852fa3bf137fb7d81041c08594_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/276-4-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download