ca853d7fff637a8222e259fb3627df802cdc569eb90319a5cabaf2ffd2725210

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b11426fb467d694f785e6858c411494f_JaffaCakes118.exe
Size

80KB
MD5

b11426fb467d694f785e6858c411494f
SHA1

817c093b9a27a0998c5b5a6fe0a3bfe504ce302b
SHA256

ca853d7fff637a8222e259fb3627df802cdc569eb90319a5cabaf2ffd2725210
SHA512

f59efe3f0b64933982b72f309e0d56cac8a6ffa4c7d8aba368299acfc825d965bfa44879d379bbf04b37ee9aae030c3cf45efda7d93a9058a4e040a7299a2723
SSDEEP

1536:jHbXGM/bnfep3JYjg2KGiIpwCr4pM22bqxFK9DD50Z5YyNnyjDZhZaYE:XW2nfQqjg2LirCr4F2qs0ZnnsDo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b11426fb467d694f785e6858c411494f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b11426fb467d694f785e6858c411494f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b11426fb467d694f785e6858c411494f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3104-0-0x0000000000400000-0x00000000004298A1-memory.dmp

Filesize
166KB

Download