199592c3e2b5eed8686e6cfd1fba913eab3da288e24e95d6896a78cc18b961d4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c989d457036a8cd110280729bd54f350_JaffaCakes118.exe
Size

20KB
MD5

c989d457036a8cd110280729bd54f350
SHA1

6eb1131800492314f7df2a8ff647bc1e7410b643
SHA256

199592c3e2b5eed8686e6cfd1fba913eab3da288e24e95d6896a78cc18b961d4
SHA512

18639c7d7de4dba659c3d062d8425ae5dcc94fc28c7d507ea48699d42f7f222fa6b70cbf3e06983e527e5903c5890703b86091566bf7249b8778719062010454
SSDEEP

384:o9z2vDyxbfTdhmccBADMTpugFvaxxKbtu/wf8X/PMaV1OdobKj3:o92W9hmccBQuixKbQdPUUs3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c989d457036a8cd110280729bd54f350_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c989d457036a8cd110280729bd54f350_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c989d457036a8cd110280729bd54f350_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4508-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4508-2-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4508-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4508-3-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4508-4-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4508-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download