2afb4243fbba3d098296a0e47959b09c6e9e139530ea9e1991eac0f1c9e01ea9

Analysis

max time kernel
140s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8cc0df04c1df63c7d0543b7bfacb96b1_JaffaCakes118.exe
Size

47KB
MD5

8cc0df04c1df63c7d0543b7bfacb96b1
SHA1

ac00f5edba16e9dc5cfdadfa9f357530468b33cc
SHA256

2afb4243fbba3d098296a0e47959b09c6e9e139530ea9e1991eac0f1c9e01ea9
SHA512

f80464ee9047aacceb432a0f7c204788e3e98d18f3c0fff09d0a3567e0585418edef0ac2929032e137a642bea305abb704219c7883a3eeae3a1c3c4c4bbfe6de
SSDEEP

768:XgNPUhXoRPj8BDSMaKhY60lY1MsOnGDS779CqpixgAUlF7z9ve8:UPaXoR78YM9Y608zDG9/paRS1zg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cc0df04c1df63c7d0543b7bfacb96b1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8cc0df04c1df63c7d0543b7bfacb96b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8cc0df04c1df63c7d0543b7bfacb96b1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2028-1-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/2028-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download