388c3ee0a077560b94fef6d8f09ad02f56db5e0f7d04fa9ba6e12f0fd9b9e306

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bb1eb7b053407342d30744c23d7fe2ff_JaffaCakes118.exe
Size

280KB
MD5

bb1eb7b053407342d30744c23d7fe2ff
SHA1

887638f5d2a8469a405e8baa602f96322c3bda85
SHA256

388c3ee0a077560b94fef6d8f09ad02f56db5e0f7d04fa9ba6e12f0fd9b9e306
SHA512

e90a8f4846ba8f2a162ef9b4df1d082ef8d1979a7c3e5b893d1da73568ac8990f869e3dce674f0cd0e1f88279af50fd55cd2023beebea07971e42a6feb9bf9c3
SSDEEP

6144:M2D6e4usYZaDAulNIHjnwuXoYkoaQThIjQOG6g6GwRw:IemSnXhjhU+6zGwG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb1eb7b053407342d30744c23d7fe2ff_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bb1eb7b053407342d30744c23d7fe2ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb1eb7b053407342d30744c23d7fe2ff_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3912-0-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/3912-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-3-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-4-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-5-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-6-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-7-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-8-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-9-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-10-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-11-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-12-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-13-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3912-14-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download