2f9fcd3352c4a660d388460d25e2c2a851bde00143393f2e83403fd78fb7290c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77aaf5e2a3383ce7092d024e3e41d1d5_JaffaCakes118.exe
Size

78KB
MD5

77aaf5e2a3383ce7092d024e3e41d1d5
SHA1

9d4625d48bab38647108346c0a4423e8067da3d6
SHA256

2f9fcd3352c4a660d388460d25e2c2a851bde00143393f2e83403fd78fb7290c
SHA512

6fbb056f9a29efc20eae132007565c14c8f4d663964eac45b735e1d57921d90c55ea932189193ef14eb2c22bf5a8e76fcf121f9d6a4e9769b0ce3d578590255b
SSDEEP

1536:tgVY/+4MdtSkLGuEVOG50QYsX1XgpLHn9sOKzw1HWxqmQnCZmsJz:i2/MbSkLGuEVOtQYsXlgFH9sOK42xqmR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77aaf5e2a3383ce7092d024e3e41d1d5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\77aaf5e2a3383ce7092d024e3e41d1d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\77aaf5e2a3383ce7092d024e3e41d1d5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4992-0-0x0000000000400000-0x00000000004288A6-memory.dmp

Filesize
162KB

Download