0efbecdf2253207f8ceef47479dfe507285a6ee09e15e51f646e7c9e96748a53

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85119328cb7af2ec170d95a7fb29d54b_JaffaCakes118.exe
Size

129KB
MD5

85119328cb7af2ec170d95a7fb29d54b
SHA1

3a0c54fa59f7cc18719297954d9ce9d9da714ebd
SHA256

0efbecdf2253207f8ceef47479dfe507285a6ee09e15e51f646e7c9e96748a53
SHA512

ae860a2b89084ded0f5739076740c754a1920c51e08784e675f2897493e7f2ffc40b7c9369f2598ca88f5d47f471d62076be4e02c35b68f1d3ba311d8bd89a2e
SSDEEP

3072:wMNvsKHpYFsLp1ZGsEK2prk0iuB5KwCeCqAhVJB0b7wMmQsr3gEe:wYkKaMp1ZGu2fiuB5KwCgyN0uQGe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85119328cb7af2ec170d95a7fb29d54b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\85119328cb7af2ec170d95a7fb29d54b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\85119328cb7af2ec170d95a7fb29d54b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4632-0-0x0000000000400000-0x0000000000796000-memory.dmp

Filesize
3.6MB

Download
memory/4632-1-0x0000000002880000-0x0000000002970000-memory.dmp

Filesize
960KB

Download
memory/4632-2-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4632-4-0x0000000000400000-0x0000000000796000-memory.dmp

Filesize
3.6MB

Download
memory/4632-5-0x0000000002880000-0x0000000002970000-memory.dmp

Filesize
960KB

Download