504de4dd262c91fa24269c19fceab2fcb4d8eedd0a3aa5e29b46ecf735e88c7b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdf7c4bc0813b45f81ca12cfc3529d12_JaffaCakes118.exe
Size 482KB
Sample240901-b24tmsxgqa
SHA256 504de4dd262c91fa24269c19fceab2fcb4d8eedd0a3aa5e29b46ecf735e88c7b
MD5 cdf7c4bc0813b45f81ca12cfc3529d12
SHA1 36fbddb58abb64620a7eba996d9432b657f00da0
SHA512 91023357213064bddbcf31513635fe9a6274b0805709d8dc98b238191cee62b6891c0941a699f850154270d0a3f3e49f5610888ff51be2a2e5424d151ad16024
SSDEEP 12288:jF9OeBwICocVTQZjP7SiTk53byH9Jpv9SYIsGvo05:BNBkocVTQZ7uik3bO9v9zx05
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdf7c4bc0813b45f81ca12cfc3529d12_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cdf7c4bc0813b45f81ca12cfc3529d12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cdf7c4bc0813b45f81ca12cfc3529d12_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-4-0x00000000005F0000-0x00000000006F0000-memory.dmp

Download