c08952dbfe442304c8b9d30a3f0163a10fbff0613f3fb65cbca72037815e8ad3

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3803a72da572f5b8b2c7b18c8adc9eef_JaffaCakes118.exe
Size

1.7MB
MD5

3803a72da572f5b8b2c7b18c8adc9eef
SHA1

c6bf367e7d5c0ce8321ade023f337ed2d3609baf
SHA256

c08952dbfe442304c8b9d30a3f0163a10fbff0613f3fb65cbca72037815e8ad3
SHA512

4832674fc465cefe399f56ed260500e857a3ba89c1de7bcf284fa215307377b6f74913310657e89796ec3081d7228c65729b09028ed4ce8c3f6dd3e8748283cf
SSDEEP

49152:H8WFTKvRHCt9GOmNMncIPjx1fRRTh3h6QTf:ncitcdNMcIb3fRVDT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3803a72da572f5b8b2c7b18c8adc9eef_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3803a72da572f5b8b2c7b18c8adc9eef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3803a72da572f5b8b2c7b18c8adc9eef_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\youxia\SpeciaBagItem\CpConfig.ini

Filesize
876B

MD5
202022ec39b6f231f5c31fe1603ebcaa

SHA1
f75d44fff5e5451811f567d9bac590b78082f7c5

SHA256
c0462157e16bb441f6200eb51712a0638bcd53dbd59d56fdb8c48ee2b526a2d0

SHA512
577f836a200b74a7b189cdbb1b0d3495f65deb9c761c415761646c91009fcb1ce98a75fda2f2592832d42807b0e215e5b956d2d411d109fdbe23f3f1b9cecd3a

Download Submit
memory/2132-102-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2132-103-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download