58cd4cc868bef38a650a3ec3d0be0b86b5ac7b0ecae24b0fe6bd99188802fa8a

Analysis

max time kernel
94s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac0828117663e06a417ee611bbbc0d7_JaffaCakes118.exe
Size

136KB
MD5

eac0828117663e06a417ee611bbbc0d7
SHA1

71511cf18e2bef83e90ca52a001b7e206a60741c
SHA256

58cd4cc868bef38a650a3ec3d0be0b86b5ac7b0ecae24b0fe6bd99188802fa8a
SHA512

5d4c3617480904b08a649261ffdef9db2188259c658186eb5d2f90494ecc182638679a98d025e63dabdb3089a34d6b2872fe19eccc00bee40c7dc15c5e1e9c3f
SSDEEP

3072:GozrS5Wr9vBCc0OOmVHEJdq9AXNliWik7chwze91:PS09vBLrVkJdqw1zFeL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac0828117663e06a417ee611bbbc0d7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eac0828117663e06a417ee611bbbc0d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac0828117663e06a417ee611bbbc0d7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4788-0-0x00000000006B0000-0x00000000006BA000-memory.dmp

Filesize
40KB

Download