94f2633132f3e9cdeb49266749581b246b163b617d33ca02093deafab3936534

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b105f3c875437d05fae859f98172814c_JaffaCakes118.exe
Size

200KB
MD5

b105f3c875437d05fae859f98172814c
SHA1

04f46395238b7f93dc3df649af2863d1b2c99cf3
SHA256

94f2633132f3e9cdeb49266749581b246b163b617d33ca02093deafab3936534
SHA512

41b05db9745552fa4f1b7f322260d30693b321d5f18a48fb723cedd6b656efb9e5378bd362f56fd599f2504f474cb1fc7853fa576b85a36aac9e997692336055
SSDEEP

6144:X1GqzXkWXLQmcuDKZCldRC7rDz0wjfHLxey6t8H8AQ0+P1QJg7:XH0sJuZCldRCrFjfHLwy6GnQ0+6A

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b105f3c875437d05fae859f98172814c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b105f3c875437d05fae859f98172814c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b105f3c875437d05fae859f98172814c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-0-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download