bf7083cb333789cbdd527f2af26685fb4409de6e916e2115d9b7d4fc00d14cfb

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8696b99fe0ae0e626fe5e810196e7d17_JaffaCakes118.exe
Size

251KB
MD5

8696b99fe0ae0e626fe5e810196e7d17
SHA1

4e551f3bde69d316460d87ff8a553d52ac27b4b3
SHA256

bf7083cb333789cbdd527f2af26685fb4409de6e916e2115d9b7d4fc00d14cfb
SHA512

a36f94f73502fa124597e50d36c02b1058c5b32788ad478c6a35668b85e1840e12bbc5df5dc47f7da6955459d4732a2c29ea1cffd429ab5996e55d49a2f19917
SSDEEP

6144:xMqmt1/EIi+aQw7gZNdbcIDwMCDUNssLTJ0rV9QilJ:9mt1EIi+aQw7gZHAIDFCAiOurV91J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8696b99fe0ae0e626fe5e810196e7d17_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4700	8696b99fe0ae0e626fe5e810196e7d17_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8696b99fe0ae0e626fe5e810196e7d17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8696b99fe0ae0e626fe5e810196e7d17_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4700-0-0x0000000070000000-0x0000000070048000-memory.dmp

Filesize
288KB

Download