756dabd9b1d102a82e1ba0abee99f604fd65056259919141261423e39a869adb

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfe7be569bc22598290c7fdb5166e87e_JaffaCakes118.exe
Size

25KB
MD5

dfe7be569bc22598290c7fdb5166e87e
SHA1

6a77a33f8c6e58a877126faee584e222ec2885a7
SHA256

756dabd9b1d102a82e1ba0abee99f604fd65056259919141261423e39a869adb
SHA512

156616adaa9aef1585038d2d1b104d224a6911248a541ff1c608f12d1fe0b18858ada58022af3ef25161166fa7edfa29c46add0de8ebceacb8adc2b149339944
SSDEEP

384:vSyaKR/rbLlmBMHVj2V3/pEl1yI4Oyy/7t04SAL2gOmZ18LUJm5xG7vvxlL:v3tRTAap2VvOt042c8oc67D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfe7be569bc22598290c7fdb5166e87e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dfe7be569bc22598290c7fdb5166e87e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dfe7be569bc22598290c7fdb5166e87e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download