14b73d3b8cddba45bbe5e30942ca8f7aeee35fa954460f1d12c64ea70e936e36

Analysis

max time kernel
89s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2c68f40cfa86ab16db65f25f242bc2a_JaffaCakes118.exe
Size

158KB
MD5

d2c68f40cfa86ab16db65f25f242bc2a
SHA1

ecbb1f79a7082740b4be65fdf4ad9f1498e7a42f
SHA256

14b73d3b8cddba45bbe5e30942ca8f7aeee35fa954460f1d12c64ea70e936e36
SHA512

0b09b49582732fbe36850617be9e7b5966d33c092dbd6475bf2e0d28233feb58e97bf43a6a18860e1bc0572ce0a46d5590a25dd8907eb94455288b415109d2a0
SSDEEP

1536:cl9cTwuyiSb6jGxkqU6ATcRgA6c/hdWk3nqZy+nSaGj/WAv83EcyEgOs4gPW:MqMu2uyZCTcGv0WkXqZy+n5uvcwPW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2c68f40cfa86ab16db65f25f242bc2a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d2c68f40cfa86ab16db65f25f242bc2a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2c68f40cfa86ab16db65f25f242bc2a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download