2d8121c01c75740b6b4a474566ec105532379f600c460377a76f1ab6a21847af

Analysis

max time kernel
148s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c9850b7bd5a6989cd8ceb7722ab278e1_JaffaCakes118.exe
Size

170KB
MD5

c9850b7bd5a6989cd8ceb7722ab278e1
SHA1

f746ca89eb2e8d6d08a0c7895aa51ec407a8cdbf
SHA256

2d8121c01c75740b6b4a474566ec105532379f600c460377a76f1ab6a21847af
SHA512

92b845b6436d3fbc7823de885ffff89a47565a5b9f726bdb3c67e65ad3650f78c0db1b0dd2183f2c5b9a8b9f659bc71040aa58ea98ad26ec968a0e0b59951c42
SSDEEP

3072:vpTTcyqvDUIE0VnJ3fUe6D5ZFL/mqsHMFPKFsjgXrnu9LOKNEzXlRQMCI:RTTcRvDVVme6knHqUI8nuxNEzXln

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9850b7bd5a6989cd8ceb7722ab278e1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4872	c9850b7bd5a6989cd8ceb7722ab278e1_JaffaCakes118.exe
4872	c9850b7bd5a6989cd8ceb7722ab278e1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c9850b7bd5a6989cd8ceb7722ab278e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c9850b7bd5a6989cd8ceb7722ab278e1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4872-0-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-1-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-2-0x0000000000132000-0x000000000015D000-memory.dmp

Filesize
172KB

Download
memory/4872-3-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-4-0x0000000000132000-0x000000000015D000-memory.dmp

Filesize
172KB

Download
memory/4872-5-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-6-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-7-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-8-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-9-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-10-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-11-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-12-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-13-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-14-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-15-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-16-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-17-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download
memory/4872-18-0x0000000000100000-0x000000000015E000-memory.dmp

Filesize
376KB

Download