a0723d39c36bced9e97672b86461e67c25d2159c9c2197f25a8735df01864a80

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb10ae274a261e335f62dabba65bba62_JaffaCakes118.exe
Size

3.3MB
MD5

bb10ae274a261e335f62dabba65bba62
SHA1

8b4f6cc2a1cbc7a40a192d18da05906761e0d161
SHA256

a0723d39c36bced9e97672b86461e67c25d2159c9c2197f25a8735df01864a80
SHA512

59d2a5dc181a919f609938b751e287af6e7573606788addf11a424a520758b9c076bde3153cfe32b6ccef0c0ff004db64941cf239069620dc7ea6ce6a98e103a
SSDEEP

98304:ck5HDykWXgoh6c0IR3F1LxRO4b7+R/QKxkmmN:P5jRWXgohL11pxRhH+jQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb10ae274a261e335f62dabba65bba62_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bb10ae274a261e335f62dabba65bba62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb10ae274a261e335f62dabba65bba62_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4088-0-0x0000000001470000-0x0000000001471000-memory.dmp

Filesize
4KB

Download
memory/4088-1-0x0000000001390000-0x000000000146E000-memory.dmp

Filesize
888KB

Download
memory/4088-2-0x0000000001470000-0x0000000001471000-memory.dmp

Filesize
4KB

Download