976f1a3a2873ea0442c118dc034d8b4be5bfdeb862b9ec5dea797c8c632ca91c

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95737f6ba26e62b21ea7f42786fad036_JaffaCakes118.exe
Size

456KB
MD5

95737f6ba26e62b21ea7f42786fad036
SHA1

3c2c05ce5e75f02b008cafaa6d8b0079716401ad
SHA256

976f1a3a2873ea0442c118dc034d8b4be5bfdeb862b9ec5dea797c8c632ca91c
SHA512

eef97a7b4ecb6cc2986cd48ed8c8d89e0b030b629fa2939ea96baf42b73c3003f99691f7efb93c0a6165050ebe41ef315cdfec3564114b2198cccc035db6ffb8
SSDEEP

12288:+uC77RBgTC+9rdncxVc12JPDYCu3QdvSbLnOc1zHPQr3WEoOjULLpluKU1nHiB:HfvnOYEr3WELU3XVU18

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95737f6ba26e62b21ea7f42786fad036_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\95737f6ba26e62b21ea7f42786fad036_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95737f6ba26e62b21ea7f42786fad036_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4548,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-0-0x0000000001400000-0x000000000357A000-memory.dmp

Filesize
33.5MB

Download