6a5b648a16a8e839053e8547594e859782d44cdec77a7f94c261751048701289

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c5210b21f48669b083d38651a4452e5_JaffaCakes118.exe
Size

810KB
MD5

2c5210b21f48669b083d38651a4452e5
SHA1

e3666e19155ada73d26d119bca85a7249e25466d
SHA256

6a5b648a16a8e839053e8547594e859782d44cdec77a7f94c261751048701289
SHA512

e13848928d1ac3cbf1c1c80dd5a67bc9f338ce96e2040970682cddbdde8f6c4fcc89296be55829769a5102ec4f80d6f3934ac2f39ab467ce5389517b629c35b8
SSDEEP

24576:Tu2DtGaveCEp1OrCI8D5mw1Czv2tepZTULsY:dvIAmB0w1C6spZA4Y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c5210b21f48669b083d38651a4452e5_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

C:\Users\Admin\AppData\Local\Temp\2c5210b21f48669b083d38651a4452e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c5210b21f48669b083d38651a4452e5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2960-1-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download