0e34b2f4dfa0806504bbc22068af819521025afa5c2e1d729d2bccada2f32e3a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afe039ce7fd9e4d6f1cd6823af5983ac_JaffaCakes118.exe
Size

375KB
MD5

afe039ce7fd9e4d6f1cd6823af5983ac
SHA1

a2fb79d0cc2b975fb5586a6447eec6373e94e02d
SHA256

0e34b2f4dfa0806504bbc22068af819521025afa5c2e1d729d2bccada2f32e3a
SHA512

6cc954fe6105b5624d9a9f1a8ed43a9c6506b72b8f88d0e3f2d716696fdcc1e4354a65954753e5a93f28d82e52c39372fe129b51b7f756d36e1ccc675a2bb24d
SSDEEP

6144:ImGl528F2idZecnl20lHRxp3gAYa7WMnU75kJ4WxM207J3UTGz4Gcf7+P:IXF3Z4mxxxYKU758xMv3U6ztcfs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afe039ce7fd9e4d6f1cd6823af5983ac_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\afe039ce7fd9e4d6f1cd6823af5983ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\afe039ce7fd9e4d6f1cd6823af5983ac_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4920-0-0x0000000001000000-0x0000000001069000-memory.dmp

Filesize
420KB

Download
memory/4920-1-0x0000000001016000-0x0000000001017000-memory.dmp

Filesize
4KB

Download
memory/4920-2-0x0000000001000000-0x0000000001069000-memory.dmp

Filesize
420KB

Download