97b844da2fde1688dc0fade858d8ecfbfea745d5d6d6d2a76bdaa3056ffd29c8

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0995452d9842220b293e402f8db1136_JaffaCakes118.exe
Size

371KB
MD5

c0995452d9842220b293e402f8db1136
SHA1

c7f22ecec9a68b6c9c4e8f2c4b6f9280e5a6b86c
SHA256

97b844da2fde1688dc0fade858d8ecfbfea745d5d6d6d2a76bdaa3056ffd29c8
SHA512

0e1e4d729a4460a9d76a357235cbf13194c2ac82af07c05d8bb57d5305d902f0d36dd1bf587a93620d6d99325f5dd8688e811b88840697087d799a5fb285828b
SSDEEP

6144:EtCBt2ybqW/oRbJKQ8Ts64VGnsOH0b6JW/6ydCGmI8T2ZlLdul38:/BcybqW/2UA9Gsw0bPDCGqToLdEs

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ug.exe	c0995452d9842220b293e402f8db1136_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0995452d9842220b293e402f8db1136_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c0995452d9842220b293e402f8db1136_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0995452d9842220b293e402f8db1136_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4304-0-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/4304-1-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4304-2-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download