4cec89fda7f5976751db6c7a1ee57ed96f92f72d7eae0471d226028635e68b6b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54a51e53b3b9b3ed1d260c0e53e86622_JaffaCakes118.exe
Size

551KB
MD5

54a51e53b3b9b3ed1d260c0e53e86622
SHA1

88c9978a25a22fd1ba208d29bbe711249304551d
SHA256

4cec89fda7f5976751db6c7a1ee57ed96f92f72d7eae0471d226028635e68b6b
SHA512

45a69e341f4268dbf0706a5bac4cc34854b5c27dd43801625a98cf12fc4c17496a2a5ae8b0d7fc65d59bf3fdf1381f8b4aebc1683acec08209e863827b15c0b5
SSDEEP

12288:R3uQG9AdRZWiQIbpGJ2TSQGx9WRAgWyEyjrwez:sQr3DC2TS19Wexk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54a51e53b3b9b3ed1d260c0e53e86622_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\54a51e53b3b9b3ed1d260c0e53e86622_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54a51e53b3b9b3ed1d260c0e53e86622_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/800-1-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download