682e2d2cbfb8fc5aa2bbf8ceee194378a0f57d75704e43e5423b9b875147cfbb

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c794428a8df15d3194f7493e76c31c4a_JaffaCakes118.dll
Size

35KB
MD5

c794428a8df15d3194f7493e76c31c4a
SHA1

521b784b9e08b68fbc4cff6b186cb14812ceaf87
SHA256

682e2d2cbfb8fc5aa2bbf8ceee194378a0f57d75704e43e5423b9b875147cfbb
SHA512

1eb22909595a02b014d3c7b18341ff8e6f30a76a991d7014aec1b5e8628f536a4da111deff7ecdc14462935faf9f1b1497a8a637482a85ab321b9ed4b54d1a2e
SSDEEP

768:qqSACC8tq/FywxWMq5DBQUVYRLWXfEcqxQ9pdJbkL3iu:qqSAuuY/5lQQYdWvua3u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3300	4292	regsvr32.exe	84
PID 4292 wrote to memory of 3300	4292	regsvr32.exe	84
PID 4292 wrote to memory of 3300	4292	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c794428a8df15d3194f7493e76c31c4a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c794428a8df15d3194f7493e76c31c4a_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads