cbfcfef9755576a95c83fe150146ece7b275626be4bb308ef4367b71479db218

Analysis

max time kernel
94s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa72c8751f7c3267228a8491e357a9be_JaffaCakes118.exe
Size

7KB
MD5

aa72c8751f7c3267228a8491e357a9be
SHA1

27c593ece2554c6a274b0eb762eabbc8dc26ce5f
SHA256

cbfcfef9755576a95c83fe150146ece7b275626be4bb308ef4367b71479db218
SHA512

a947d1e8bf06d70020e61966d9154f60e31f6dc79b67cf90b01356f4a84d49e374e195bf7076a257e1efb8dd7946a6b7ef323202283d7d958383d3c0775a6913
SSDEEP

96:Z1ZcErLy3vkX3Z2KrFJfwSvGzsY+YpeH2BT+y/d7toF13qL:9trL4Ap2oGSvGzsYdeH2By0d7Cs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa72c8751f7c3267228a8491e357a9be_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa72c8751f7c3267228a8491e357a9be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa72c8751f7c3267228a8491e357a9be_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download