246849c7fc708a6c0d9bb2c093bf2ee493138844358bb35d952b7c8f646789a1

Analysis

max time kernel
133s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbfb34d6cfe465bcc93430e4f2d04d7a_JaffaCakes118.exe
Size

105KB
MD5

bbfb34d6cfe465bcc93430e4f2d04d7a
SHA1

33b8afb3d3d69c289e65d4ef950e063bf974721e
SHA256

246849c7fc708a6c0d9bb2c093bf2ee493138844358bb35d952b7c8f646789a1
SHA512

07687dffe415f5758507874e70af8d87d0d2a39f365c2e0fdf5b33bd0a3b192e111c5ca81665b3ac559a25d711c375bb74c69f6e1920a93fd58b71a4b588a643
SSDEEP

1536:3eGofGrCjmbtc14WWnmIby0LItbe7T9D6ldGO9XMH3uu9B+w73dZq9znF9wOI5oQ:OGaMCu+1om4L0b9dnOH35+wK93IazBu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbfb34d6cfe465bcc93430e4f2d04d7a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bbfb34d6cfe465bcc93430e4f2d04d7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bbfb34d6cfe465bcc93430e4f2d04d7a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4388,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3884-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download