573b7b72766d4fc8c33375248b943a8168fb2ee9c3f8e15f8210ef03dfadc56f

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84e07bff6a40b70b9f8ee6395a480b23_JaffaCakes118.exe
Size

872KB
MD5

84e07bff6a40b70b9f8ee6395a480b23
SHA1

a889943f622a68e20f9c400ad43e9714aa0f1ea6
SHA256

573b7b72766d4fc8c33375248b943a8168fb2ee9c3f8e15f8210ef03dfadc56f
SHA512

909c881d94a85a21030d2dbe311e1fdd85c6209187c2c381257590f327d871a10f2c2ab217369c60736ceb823e14482c2fbe91ed93aaea8e22b0a9c4b2e0a1df
SSDEEP

12288:4F+pYGcXeb2Vm3YXKwhPwPCIuZxC7es3xlCZj8xe6qXABmLS2Zsc4Ez:LYsb2EoV1IuZcP3x4Zj8xe6vB2ZscNz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84e07bff6a40b70b9f8ee6395a480b23_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\84e07bff6a40b70b9f8ee6395a480b23_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84e07bff6a40b70b9f8ee6395a480b23_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3744-0-0x0000000001000000-0x000000000112C000-memory.dmp

Filesize
1.2MB

Download