a65d733a1b72befa4b7e458b5088c4429955300c4576adb964bf65e2b30b8ea5

Analysis

max time kernel
94s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee0adcbb4c9e73acff811a53a736a175_JaffaCakes118.exe
Size

262KB
MD5

ee0adcbb4c9e73acff811a53a736a175
SHA1

9d28c12722a4fcb3309911ee08ad0c30a8fbcbfd
SHA256

a65d733a1b72befa4b7e458b5088c4429955300c4576adb964bf65e2b30b8ea5
SHA512

bbafd6c51867ba8f484379d80c9d7a16af76d373698d079725af7f86c23a09a5e821789cdac8b6f9e950a2e4870b51cb8d0c4bc4fb6e13c9c2df9fd620c10bbe
SSDEEP

6144:SX8Gp+df0afmVTRMd0dpn94sLrNXel9rb98+MAnN:g8YkfXf4TRM094svNuzrb9ZP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

ee0adcbb4c9e73acff811a53a736a175_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee0adcbb4c9e73acff811a53a736a175_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee0adcbb4c9e73acff811a53a736a175_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ee0adcbb4c9e73acff811a53a736a175_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee0adcbb4c9e73acff811a53a736a175_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-0-0x00000000020C0000-0x0000000002101000-memory.dmp

Filesize
260KB

Download
memory/3144-1-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download
memory/3144-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-5-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download