6e2e7a82a4bcf4cc4e275cbfea3b39457ae6afbac435f4c701979d3d06c64675

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29fc2f45e7e3e123fa60f679bc965544_JaffaCakes118.exe
Size

3.2MB
MD5

29fc2f45e7e3e123fa60f679bc965544
SHA1

79e66a7b853debbc230f315ec3080b655f95fede
SHA256

6e2e7a82a4bcf4cc4e275cbfea3b39457ae6afbac435f4c701979d3d06c64675
SHA512

bd6bed935321c34d65253191d059e545ffbf044ec52f8df55994b10f9463d472fbb034b1a7feb05224ac20eaec777a31903c4e80f494b65ef502d21435e8e115
SSDEEP

49152:fDaxERhpOjmZdjVEVDTwXbOhdbsowBhLjCpf4t7+N2jQoLoUoQpbxsRUrCgHfB:fWin8jsdWVDQKhMB1jCpM8kbORUugHJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29fc2f45e7e3e123fa60f679bc965544_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\29fc2f45e7e3e123fa60f679bc965544_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29fc2f45e7e3e123fa60f679bc965544_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-0-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download