8a4d241f9271867ac2a9c0dde519ce35bd124963afab5bac6cd4345652d0ad37

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac5a5501d303f80dd3edad872020e434_JaffaCakes118.exe
Size

265KB
MD5

ac5a5501d303f80dd3edad872020e434
SHA1

f6494c150af88eabc87ba91c619e199b763b705d
SHA256

8a4d241f9271867ac2a9c0dde519ce35bd124963afab5bac6cd4345652d0ad37
SHA512

62da611fa2b0634ec79afbafa11e51ecfea1c162976dae858ee9f26d9a54464cb8d714ea58801779c82af2838e5a3a2922df9002ee0ab0ff3fe5a051982b64c5
SSDEEP

6144:Ut3SxqWBztdjrNg9HNO1CbyNFfcN+2dsiVwuI5rq2T:MCxqEzLiHNO1CGTfc0e2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac5a5501d303f80dd3edad872020e434_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3268	3188	ac5a5501d303f80dd3edad872020e434_JaffaCakes118.exe	84
PID 3188 wrote to memory of 3268	3188	ac5a5501d303f80dd3edad872020e434_JaffaCakes118.exe	84
PID 3188 wrote to memory of 3268	3188	ac5a5501d303f80dd3edad872020e434_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\ac5a5501d303f80dd3edad872020e434_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac5a5501d303f80dd3edad872020e434_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ac5a5501d303f80dd3edad872020e434_JaffaCakes118.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ac5a5501d303f80dd3edad872020e434_JaffaCakes118.bat

Filesize
296B

MD5
356852200441c5427b1dbdc5b70c89ad

SHA1
573688a201c5e9597f26b3a5aa03d24b030e5811

SHA256
d00a7dc59c5190a469c7f4eb7ba338dcecb09207a86b6bec78aadf9fc9da6d18

SHA512
40b664298d2e09596c56cb6c336b74b930448d21c3183672a77840170c87befb76fc29871de82324a2971f56362828490354025473e6bedd5f4daa6b088f51e8

Download Submit
memory/3188-2-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download