b78c3ad08eebda0bfd73e04115de4f4c16d7a1a691455a1a65d879bafe338b79

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c09281d2f6be5dc67714c176988645f_JaffaCakes118.exe
Size

125KB
MD5

2c09281d2f6be5dc67714c176988645f
SHA1

ece2591e2db50bab2b8efe4b8b444ae8483cb320
SHA256

b78c3ad08eebda0bfd73e04115de4f4c16d7a1a691455a1a65d879bafe338b79
SHA512

870ba40184bb41a3a2a92cfa821e728e148fd19d19a8f942dd35521c3d6142c63b854e8b98100697d738f8cd26c7cea64cbdd365e5c1bf6b554336ea192de976
SSDEEP

3072:FLk395hYXJayavopC1yfitPHeqo3Sc//////Q3I:FQqsyagpOyqTNc//////cI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c09281d2f6be5dc67714c176988645f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2c09281d2f6be5dc67714c176988645f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c09281d2f6be5dc67714c176988645f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...