6c37073874aca959ef30f1b5aa2c27880d2d2c597e57190bbac4e8b5610806bc

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_33b08a360005de89b7ccfc28fca2b1af.exe
Size

163KB
MD5

33b08a360005de89b7ccfc28fca2b1af
SHA1

8fe2e711e11726c29a33574f8fb8ba3de16f50d6
SHA256

6c37073874aca959ef30f1b5aa2c27880d2d2c597e57190bbac4e8b5610806bc
SHA512

dd747482a6675a8c7e4c98b1cd20e143d2703acb7f3e094548511208bd9bbdeca346fb1f40edf96e19f479ddff8398130ae1bd3655c3a6960dd6aa81e88c863b
SSDEEP

3072:Zs164xHeWJiZJlKsg+fTW/mlgGGtl6X4vPV+I4rdCO0SfLRHw36XRx0:ZscJk+fTWOiGGtl/vHerc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_33b08a360005de89b7ccfc28fca2b1af.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_33b08a360005de89b7ccfc28fca2b1af.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_33b08a360005de89b7ccfc28fca2b1af.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-0-0x0000000001000000-0x000000000102C000-memory.dmp

Filesize
176KB

Download
memory/868-1-0x0000000000170000-0x000000000019C000-memory.dmp

Filesize
176KB

Download
memory/868-2-0x0000000000170000-0x000000000019C000-memory.dmp

Filesize
176KB

Download
memory/868-3-0x0000000001000000-0x000000000102C000-memory.dmp

Filesize
176KB

Download