aec2cdc8c122ea9e36cde497dfe4e212eae9f7afda8971587adb52cb5f3bde34

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3947394e08e1056ceb001ab2c530d3af_JaffaCakes118.exe
Size

126KB
MD5

3947394e08e1056ceb001ab2c530d3af
SHA1

b70111ff17eab97643397bfd8d14938e2c90e5ac
SHA256

aec2cdc8c122ea9e36cde497dfe4e212eae9f7afda8971587adb52cb5f3bde34
SHA512

2202d7ce3c0f0835b1e7e441b758ec76752755c410d64bc943c17f2b0d21f7c8a6e5c08b7e992b6ad20af565a95c43d81f245b48dd595f67d4f44e452270bc9c
SSDEEP

3072:KpxfDl5ouJBr1vP4zF13l1VsCoqbZSjmF9:OxLg4Br1KF11DVoWSjmX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3947394e08e1056ceb001ab2c530d3af_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3947394e08e1056ceb001ab2c530d3af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3947394e08e1056ceb001ab2c530d3af_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download