67e7a5422647c7cef399c50f513fa63ded475b7bf25864ecd835e44cef498eb6

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29783c1133869470a5171053acc790bc_JaffaCakes118.exe
Size

140KB
MD5

29783c1133869470a5171053acc790bc
SHA1

493da678d21d14631c0352b4640d31bc18acbc38
SHA256

67e7a5422647c7cef399c50f513fa63ded475b7bf25864ecd835e44cef498eb6
SHA512

26584dac12a97b54029ea4bb8f61f32c30d402ec686763473c2d12000640f09745bc696a4d1d261e009cc8a63c9392ee72fb1808e1c13e1539da9763e78f318e
SSDEEP

3072:zoBiFMvzvgrooEOEepk/iYa2JltAk5s6o+SljpZ:zPGvzv8BEOEepOuQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29783c1133869470a5171053acc790bc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\29783c1133869470a5171053acc790bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29783c1133869470a5171053acc790bc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download