03e3cc01a263edb9aefb411ebf2efb74d2130651400dc3baaa5e344ff1ec47ad

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 15:02

Target

6f8987e28fed878d08858a943e7c6e7c_JaffaCakes118.exe
Size

177KB
MD5

6f8987e28fed878d08858a943e7c6e7c
SHA1

1fb1d7408e99195e23a71f49ce31bc90041dd4ee
SHA256

03e3cc01a263edb9aefb411ebf2efb74d2130651400dc3baaa5e344ff1ec47ad
SHA512

e42427a6603379938ba40cc7d0b1608458a9d3f22af6811b291b3e6e5fb2cc28cd991b54f106cb8a5f661adb69817d55f54c5b1f557a7c8cc6f74ba7906f6f36
SSDEEP

3072:l4k3pHqF6aRVtp0MgGaEwASYJrUb3M60P+x0HmbEVLLSLfmo0h7yDb7fCXcBkbCs:ppg6Abp0MgGaErlJSBEVaLOJZo/NuK7e

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

Processes:

6f8987e28fed878d08858a943e7c6e7c_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f8987e28fed878d08858a943e7c6e7c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6f8987e28fed878d08858a943e7c6e7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6f8987e28fed878d08858a943e7c6e7c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2016

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2016-0-0x0000000002670000-0x0000000002700000-memory.dmp

Filesize
576KB

Download
memory/2016-1-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2016-2-0x0000000002670000-0x0000000002700000-memory.dmp

Filesize
576KB

Download
memory/2016-3-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2016-4-0x00000000002D0000-0x00000000002F0000-memory.dmp

Filesize
128KB

Download
memory/2016-9-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download