0870ba0f0e42d95fddf1621af6bcdb29ad15e0e27f9173c582e91faf0d9d8f8d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7a90a3ba61fe35752fbaf4fe2a6acb5_JaffaCakes118.exe
Size

47KB
MD5

a7a90a3ba61fe35752fbaf4fe2a6acb5
SHA1

a3210913bd6768dd442eeb247bb7bd939b2b34a3
SHA256

0870ba0f0e42d95fddf1621af6bcdb29ad15e0e27f9173c582e91faf0d9d8f8d
SHA512

59b81fad8d182c7903c6354bbd73121f16736085bf434a970c514ae5bd1bd1263bff3e66bbda2c7df33f1f25848d619dfa446451b0c916632db5f8238c6e935c
SSDEEP

768:VmpM8hMmLsOhUE1yzdlDAKKfWRGYZoWiuibnqen7rLlc+JFiGcXofIjIK0+:VaPnuz/JKWZvizqen7o4fyb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7a90a3ba61fe35752fbaf4fe2a6acb5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a7a90a3ba61fe35752fbaf4fe2a6acb5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7a90a3ba61fe35752fbaf4fe2a6acb5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4100-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download