8f8e48753a4ed5b81d9c7e06c27531e746f025be4e3288a247531c415d049ab4

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89454596cb0c2d9f5c73fb3da64732a2_JaffaCakes118.exe
Size

524KB
MD5

89454596cb0c2d9f5c73fb3da64732a2
SHA1

4a240ad7a638bcec467f81f6aa74778181d25f81
SHA256

8f8e48753a4ed5b81d9c7e06c27531e746f025be4e3288a247531c415d049ab4
SHA512

bc6081b4f3906a187da9f73c6382bbb0a9b079c619a559da380093771c4561e89758a70c38e05c6a93fc79ddb78c1e38bdbbd03d37d6821ebfaa7978aa0d03d9
SSDEEP

12288:3av8hDg3aOICQec1Ch7xG+GHLzMXrohLqYiJ9xB0wxr:k8lg39Qec1CzGHHMUhLFiJ3Bj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89454596cb0c2d9f5c73fb3da64732a2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\89454596cb0c2d9f5c73fb3da64732a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89454596cb0c2d9f5c73fb3da64732a2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download