2de062af288dcfcb21adc6319fdb2f654f90b7df3dd76794785ed35e85f78076

Analysis

max time kernel
139s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95c85305dbbc58017d47ef0d588266d0_JaffaCakes118.exe
Size

840KB
MD5

95c85305dbbc58017d47ef0d588266d0
SHA1

0cff2258adf936410698d94ec2d767691fd23475
SHA256

2de062af288dcfcb21adc6319fdb2f654f90b7df3dd76794785ed35e85f78076
SHA512

b048c2330ce4fe0d1689270deba88d3ccac89da2ce25f47343d2886cc83f1f7d719991d8d91e0421ce8693292cec5d6e4c301f1c892fd026473d7d1e9df06fea
SSDEEP

12288:uk2UeehKwocpZs8iUcD+kPaY3u2psptJMmQbdF8TF/36AiQyl/RJzjTe0:tteehKGvxcJPbjpspsmQW6AKZlH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95c85305dbbc58017d47ef0d588266d0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\95c85305dbbc58017d47ef0d588266d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95c85305dbbc58017d47ef0d588266d0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4700-0-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/4700-1-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/4700-2-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download