73ed8ce68fc4935085e2ff354dc5fd92c3794f1b9b658b9ef9f0edcf99d746ef

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0d4ae46617d0d87c468c137def5dcd8_JaffaCakes118.exe
Size

43KB
MD5

f0d4ae46617d0d87c468c137def5dcd8
SHA1

f25bd979f2dc2015a7129c442cb7f02d26e3f7b1
SHA256

73ed8ce68fc4935085e2ff354dc5fd92c3794f1b9b658b9ef9f0edcf99d746ef
SHA512

259009dede7d0e079acf5260b30449a460aa39316fc4b1236fead5777ef86bab24d690a5c3115969893c2ca9c407a271ee9f76ea7a4f8a6b8f66778b7a66aeb1
SSDEEP

768:eBKJnjqi9SPyLf8oYRZ5HqZJP7uSjlQA22oiZrIqZDMm/9uJb:eBKJn3SmfYRrKZPjlt2dY9uJb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0d4ae46617d0d87c468c137def5dcd8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f0d4ae46617d0d87c468c137def5dcd8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0d4ae46617d0d87c468c137def5dcd8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4864-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4864-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/4864-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4864-3-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download