f1b7365af1d10d2f9dfd393faa9373a14a2229b1761e267b7cdc35324bb54589

Analysis

max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

952875e5c300a1869655c24f64480c96_JaffaCakes118.exe
Size

191KB
MD5

952875e5c300a1869655c24f64480c96
SHA1

a2719d07bf8de24956270b44e6679f89f9b1311c
SHA256

f1b7365af1d10d2f9dfd393faa9373a14a2229b1761e267b7cdc35324bb54589
SHA512

442373705315c0f90a93bca91d0dae36f97f79903e4680fb979677bf51f551f130f031cd50eb9437af46223624ab7f4f1606a96184536a0c9c6d013ec8f727da
SSDEEP

3072:+peq5jppdyPxJsHUUBYN0fo+y6pz6xxrrLCvARCgSxleNdF6k1LUpuMsDGi7/l:2eQtyJY7YX+v+7+vztxleNdFfLtKw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	952875e5c300a1869655c24f64480c96_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\952875e5c300a1869655c24f64480c96_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\952875e5c300a1869655c24f64480c96_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3224-0-0x0000000000429000-0x000000000042C000-memory.dmp

Filesize
12KB

Download
memory/3224-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3224-2-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3224-3-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3224-4-0x0000000000429000-0x000000000042C000-memory.dmp

Filesize
12KB

Download