6497ca0074eb3d0406bcd201fc22aa2e78b98d0ed680eeb7182af4d377e2c0b3

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1c7f02e9272fafc7b04faac0286c67e_JaffaCakes118.exe
Size

21KB
MD5

e1c7f02e9272fafc7b04faac0286c67e
SHA1

aa26416f6b65f300cbbdee1cf364a980ec26cdd6
SHA256

6497ca0074eb3d0406bcd201fc22aa2e78b98d0ed680eeb7182af4d377e2c0b3
SHA512

c7968127cebe8b442773888ad9a7b66cc0a833e2e441cf708b5b0c6e954086ef90f8dde53cdb85fcf7677382d652635aa35adb5d98f97ed21e3b3b502e85b161
SSDEEP

192:A8p3FSqQMXezYS6SdZkQ5gYCN8XruPUPQXXXPonoeSGWGVqQt/PfOhQ:AsFxQ7YFSdSQ5hrXP2XXRQV3OhQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1c7f02e9272fafc7b04faac0286c67e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e1c7f02e9272fafc7b04faac0286c67e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1c7f02e9272fafc7b04faac0286c67e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4276,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-0-0x0000000000205000-0x0000000000206000-memory.dmp

Filesize
4KB

Download
memory/636-1-0x0000000000205000-0x0000000000206000-memory.dmp

Filesize
4KB

Download