eeb0ffa0419068895f38fa502f258297286b379ec45b09a2d7cd51445729aea3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05913cf8a4fe9595215f0d98468a1508_JaffaCakes118.exe
Size

184KB
MD5

05913cf8a4fe9595215f0d98468a1508
SHA1

68ecdda3e5cf8ed552197225844569a85bf6f6e8
SHA256

eeb0ffa0419068895f38fa502f258297286b379ec45b09a2d7cd51445729aea3
SHA512

dd8f616759186ad5a135aaeb17faed76eef6e9c69d2578ed1d7b8bf245c823eeb8cf1bc56a5b675169225afc93cd85919b8eb688e3f779bf9cf8422a234c95df
SSDEEP

3072:se+zkE3pT/1zinUVFOz41Me/WDK42UuFW2Kp5Ze8k3ZxwSPgY7:8z91VfEtRDKq6q5Zg3XwS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05913cf8a4fe9595215f0d98468a1508_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\05913cf8a4fe9595215f0d98468a1508_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05913cf8a4fe9595215f0d98468a1508_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x00000000005A0000-0x00000000005B9000-memory.dmp

Filesize
100KB

Download