589102099622ea5e39289aee3819242650a5b5f418eb6827c4c60201a09161e2

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7580de5edbe07ae539d7021b092d2b29_JaffaCakes118.exe
Size

262KB
MD5

7580de5edbe07ae539d7021b092d2b29
SHA1

d3839b47e35cc6c14872b164d71d137ef9211f70
SHA256

589102099622ea5e39289aee3819242650a5b5f418eb6827c4c60201a09161e2
SHA512

1b1555631e3f9510d0d1fdf2cabeee33b5408ee738358c3f2bceafd4c02b201d8ac00f21004eab8d56cc39ed4c9be7984e68df66187810dca6382fee8011f15e
SSDEEP

6144:HU8Gp+df0afmVTRMdOdpn94sLrNXel9jb98+MAkC:08YkfXf4TRMS94svNuzjb9ZD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7580de5edbe07ae539d7021b092d2b29_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7580de5edbe07ae539d7021b092d2b29_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7580de5edbe07ae539d7021b092d2b29_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4192-0-0x0000000002210000-0x0000000002251000-memory.dmp

Filesize
260KB

Download
memory/4192-1-0x0000000002260000-0x00000000022A5000-memory.dmp

Filesize
276KB

Download
memory/4192-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4192-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4192-5-0x0000000002260000-0x00000000022A5000-memory.dmp

Filesize
276KB

Download