fc2de729f8ec29760c944df3a14f7362fa81304ed7a87d4458c849aab9aa65bf

Analysis

max time kernel
79s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9727764b96cd63578693b9a3f3fc59a9_JaffaCakes118.dll
Size

236KB
MD5

9727764b96cd63578693b9a3f3fc59a9
SHA1

67e290d239ae47a526788b4a86a5f5f9c9fbb389
SHA256

fc2de729f8ec29760c944df3a14f7362fa81304ed7a87d4458c849aab9aa65bf
SHA512

7c9c43935f25738020b1c5f47d2e87a297030886ec7facdd8e669d2feebe3cbb2fdaf6afd2d43855be4f633ea04b9ef26c60198dc2a4ac578283ea40e5bffe1d
SSDEEP

3072:J2HvXXx3fcw3G0YHp+AgmpLmQlU/qR/ySQ4cTx3i8ObR1CP:QPxPr3omQlhR1cibR1CP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2904	3496	regsvr32.exe	88
PID 3496 wrote to memory of 2904	3496	regsvr32.exe	88
PID 3496 wrote to memory of 2904	3496	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9727764b96cd63578693b9a3f3fc59a9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9727764b96cd63578693b9a3f3fc59a9_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads