2b8419cf8356e31779adb6e85ced800f00356aa319ba67d10ce8dca4e308c381

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4543934b0f2e0c117ba25ca432a1d0c_JaffaCakes118.exe
Size

1.4MB
MD5

f4543934b0f2e0c117ba25ca432a1d0c
SHA1

dbaa919c9c87a67ffe6a07a605d605406f92036c
SHA256

2b8419cf8356e31779adb6e85ced800f00356aa319ba67d10ce8dca4e308c381
SHA512

df6fb446f3e4bead4fd01b7193106c0c087393af6a7fb196dcfd14bdd0727976a9f0b2e2fc52f307e70148519e21562d049350e08aefc04dc6c767eab355d441
SSDEEP

24576:iwRivqynd9tKAoORe39BwXMhdvRwBEM4TQ8DsiDaCaJZ183LuDd:iwcvBnJLe39fhJsEM4TRSC+SiDd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4543934b0f2e0c117ba25ca432a1d0c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f4543934b0f2e0c117ba25ca432a1d0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4543934b0f2e0c117ba25ca432a1d0c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-0-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/216-1-0x00000000023F0000-0x00000000024DD000-memory.dmp

Filesize
948KB

Download
memory/216-2-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download