1df40ec2b2ea0fe26f9c9e546b78808e66a1f3411b66a4e39d6cef59fdd4a42f

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7090812e8c05d77bd374b46931c51c77_JaffaCakes118.exe
Size

934KB
MD5

7090812e8c05d77bd374b46931c51c77
SHA1

0aab13c820297b4ad1b7db13087a981c77600f76
SHA256

1df40ec2b2ea0fe26f9c9e546b78808e66a1f3411b66a4e39d6cef59fdd4a42f
SHA512

bc9b9be1e3124857aabca1e1a2bd26d377e429cfee4dcdb39f7627eed085a2337ed517e0a841282fb906bf9f3607d4eaef0539f2ce2d2868b6956c10970d4994
SSDEEP

24576:EZmxydzAm0n+1g13XXxIHgJlA4YjoY6Zyjtn8e6CsefY8AA:EZmxbJ8wVJlA4YIYn/6WfY8AA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7090812e8c05d77bd374b46931c51c77_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7090812e8c05d77bd374b46931c51c77_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7090812e8c05d77bd374b46931c51c77_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-0-0x00000000001B0000-0x00000000003D1000-memory.dmp

Filesize
2.1MB

Download