a0ab6a23284ba450a9857d417b322671da62247fa8d3689cd5378314c400b1ec

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

78a01c6a782c134169a8f60c7bfb4ba1_JaffaCakes118.exe
Size

176KB
MD5

78a01c6a782c134169a8f60c7bfb4ba1
SHA1

1ae0fbb4a186cd91b7d01592fe22803b01ec3f86
SHA256

a0ab6a23284ba450a9857d417b322671da62247fa8d3689cd5378314c400b1ec
SHA512

a4533f87025918c41db8fb8084f9d7fc1071e3e1355a29d490a3e63e10c41ed55acd2247dee9dcfa9ae1e006ad11f98ebaccbf7956e0f92cec1a30a39ef63aea
SSDEEP

3072:77N2ITMbY9q6AccMyJk/MNNrTcft7cBo3cs0aUKGh265SbBYhdD3jhAYyFvsd:7RTME9hAfJBL4ftIyPLs8WdXhAYyFu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78a01c6a782c134169a8f60c7bfb4ba1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\78a01c6a782c134169a8f60c7bfb4ba1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\78a01c6a782c134169a8f60c7bfb4ba1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4184-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/4184-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4184-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4184-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4184-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download