475e6b9a8c2f22ce7696bdb2754cae0affeba0d17d6a1186131033a7c83360f7

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 04:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb8a8d52420c7bb13d8b04bfcc92d372_JaffaCakes118.exe
Size

1.1MB
MD5

fb8a8d52420c7bb13d8b04bfcc92d372
SHA1

5acc1e1f63390b0f6e935f1b03bd292e2d9fc8cd
SHA256

475e6b9a8c2f22ce7696bdb2754cae0affeba0d17d6a1186131033a7c83360f7
SHA512

191c0cb3f46c925f23e63c9c7602bc7dc17c56d32c3e6162ceafa2d84c68165296bda7e54983d691afb5335426617517096e4a93bd0892fd1365d34f083ad207
SSDEEP

24576:ALtqG48YnteIUBR/2N5mAkPZXkk/NxyvxGSlQAg0gs7y7+5F6uso:uZ48mHUB18sA6ZXkOnyvxTQAg0gs7MKh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb8a8d52420c7bb13d8b04bfcc92d372_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fb8a8d52420c7bb13d8b04bfcc92d372_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb8a8d52420c7bb13d8b04bfcc92d372_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3016-1-0x0000000002290000-0x000000000237E000-memory.dmp

Filesize
952KB

Download
memory/3016-2-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3016-3-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download