f68507ada61f990a9422b584cc942dd31b98956cd1d521eb533e17ed65c3942d

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2475c4bcb259cbf88033c0d5247b9c2_JaffaCakes118.exe
Size

36KB
MD5

c2475c4bcb259cbf88033c0d5247b9c2
SHA1

743be5bd5cfd9313ce891831872288285f5f43a7
SHA256

f68507ada61f990a9422b584cc942dd31b98956cd1d521eb533e17ed65c3942d
SHA512

65a1a9a668dd4454eed21210cd3a18b09120623e5c495f884c2b239ea4c6586d94a0bdf26ca3a6a861fe1aca9cd4fae1fecc88759179d86ad8fd0defead378a9
SSDEEP

384:/x0iwxqs1Qm9u90KYtAzhvW0+QfAhxolkG4g0eROkk1tM4NQh9+h:CiwxqsQDN/tjTfAMlkDds+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2475c4bcb259cbf88033c0d5247b9c2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c2475c4bcb259cbf88033c0d5247b9c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c2475c4bcb259cbf88033c0d5247b9c2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download