c1851b4df4b4af2c27c080371831646ae1ba2a9fa30c757dcaa597d5f38a0788

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f9e485a963038880d48c625c14f8ccfa_JaffaCakes118.exe
Size

548KB
MD5

f9e485a963038880d48c625c14f8ccfa
SHA1

6672f5b59a0c97ccdc7e2d77779eaa7072d2f261
SHA256

c1851b4df4b4af2c27c080371831646ae1ba2a9fa30c757dcaa597d5f38a0788
SHA512

c63c7b2832fb16fa82be87b1b21218fef60ba5a276cf38d21687c772e430178a3247b26c0aa03c3de4d6f101bfbc0542f90bf37f12ded4e53453405487a948c6
SSDEEP

12288:SUtph7oXgNAKOwNB3fkMuh+5YnemAiJoDSM6mGIR9lV:rXh7oXgaKDBMr+WAdSM6m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e485a963038880d48c625c14f8ccfa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f9e485a963038880d48c625c14f8ccfa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9e485a963038880d48c625c14f8ccfa_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-4-0x00000000007B0000-0x00000000008B0000-memory.dmp

Filesize
1024KB

Download