1bd9c69e62095880c7416d183ea26f4d90abe8864c2a6e8db3f879895c0202cf

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 05:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84f480d0d2cbffe94be2f15158fdc557_JaffaCakes118.exe
Size

1.4MB
MD5

84f480d0d2cbffe94be2f15158fdc557
SHA1

8126b12779d2ae316075112485f719df74fa7b5a
SHA256

1bd9c69e62095880c7416d183ea26f4d90abe8864c2a6e8db3f879895c0202cf
SHA512

192bab12b4f9c0486ae5237b3c5a72a0a2e049cedeb20a6a6c3bfde7321bd91850c27b9da5385a0c87a7aabc81ccc8eba9f2d0a61f61a951d638b35991b27a70
SSDEEP

24576:QGCCOWNOQancuBRwsn6c6Z7ZEF7FD1kHaTp82SjR53rWzQ2YL+:DCCqznjBOhc6NZEpFDC6dRSjvWzQ2/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84f480d0d2cbffe94be2f15158fdc557_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\84f480d0d2cbffe94be2f15158fdc557_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84f480d0d2cbffe94be2f15158fdc557_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3828,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download