ac2f3621ac2e6b3124b8febdc40433d5b3ece8b6c5d0bf5e1d792baf846c1011

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed58bbad5a69c895c49b6ff491f6bc2_JaffaCakes118.exe
Size

132KB
MD5

3ed58bbad5a69c895c49b6ff491f6bc2
SHA1

3a6fa50d08f517bbd7f5952649020f02c02bed88
SHA256

ac2f3621ac2e6b3124b8febdc40433d5b3ece8b6c5d0bf5e1d792baf846c1011
SHA512

9eb23387b4e51b6bfe0f6a1a77ce8229f1d31429bbe9670c53c845e12f6bfa647a63713f043f3ef48c31160390ee94af14e7ca22b51e9f48fe9756fa9aa8a628
SSDEEP

3072:ZnRD8xQq90Ru66Ac1MhqqxORlBIjojZqMN:7DXRu66f1MhqqxvMv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ed58bbad5a69c895c49b6ff491f6bc2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3ed58bbad5a69c895c49b6ff491f6bc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ed58bbad5a69c895c49b6ff491f6bc2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1900-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download