5a79974200a2a144c0d2eb24fce2b7b3984b168057b80ff3808202a8c883cbfb

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bda68a89f7c444f6edc0909fc0a38446_JaffaCakes118.exe
Size

93KB
MD5

bda68a89f7c444f6edc0909fc0a38446
SHA1

966d84e375b8b7bebf95b14885a881bce1a019c7
SHA256

5a79974200a2a144c0d2eb24fce2b7b3984b168057b80ff3808202a8c883cbfb
SHA512

af7e92827492c295cce86bfaacb2f340ef4a1053946a9aae1cb3bd11041acba96a5c9519de844bea317e3afe61b23c49d0b55ebc3dbf5cb95bae5cef349ff30f
SSDEEP

1536:dRZ/SPQOMLY2kHPhyjeYuKXPIJNYhuOPxIXSpvE/xYM1z+TbTs15y7BMe:fZ/SPQOMLY2kvhZKwJvSpsZl+T3B

Score

8^/10

discovery evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bda68a89f7c444f6edc0909fc0a38446_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bda68a89f7c444f6edc0909fc0a38446_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bda68a89f7c444f6edc0909fc0a38446_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3280-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3280-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3280-2-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download