c10f08b6bf02606e5437a2601064174865a80e2864d93f8a468e2ba50e81fa75

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd5c5efb72d4af0a8be438e599aeead7_JaffaCakes118.exe
Size

656KB
MD5

bd5c5efb72d4af0a8be438e599aeead7
SHA1

651f27c81e831d4dea51f42b1debfa7930900043
SHA256

c10f08b6bf02606e5437a2601064174865a80e2864d93f8a468e2ba50e81fa75
SHA512

90fba26e3959c6aa70a62363b02aeeb71ea117c60c663baae69cc21acdb995637e7f90d60e3525400508f677fd83067764314df3398bf312a9a0efe977c885ff
SSDEEP

12288:3Os4CcDP2+yyyrCN05y1zjveRQOywABUW8ViIQU1yCwrj2:3f4tDe/rCVX5xwABUW8ty

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd5c5efb72d4af0a8be438e599aeead7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bd5c5efb72d4af0a8be438e599aeead7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bd5c5efb72d4af0a8be438e599aeead7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-0-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/880-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/880-2-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download