66d2844ce22045da78e34ef5444f7dbe5b2cf3569ced4a9aa0efb21e0fc22542

Analysis

max time kernel
140s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd496d1420302bdd4944cb1361d93486_JaffaCakes118.exe
Size

396KB
MD5

dd496d1420302bdd4944cb1361d93486
SHA1

e0dfe4102986d26ec8c29b2cc7bfddaa039cbbb4
SHA256

66d2844ce22045da78e34ef5444f7dbe5b2cf3569ced4a9aa0efb21e0fc22542
SHA512

ee2cf7a827dbb8e54ac66346177a583961f71cca5744af4c6061e48c5457270cfc3d3f713c22fffd8633704179e447cfc19420235d027ee5ef63a7062ab5ee59
SSDEEP

6144:42Mg6q5i5UEHFeZLsLj4wDSuuDcP5+sJCWUasUg9A2IRQJ3R2CL0xPOuZEuvqdm:9Q5UEwmLj4qHBBJCW5uA2I69RWmu+uik

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd496d1420302bdd4944cb1361d93486_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dd496d1420302bdd4944cb1361d93486_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd496d1420302bdd4944cb1361d93486_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3308-1-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3308-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download