2ab1caec6bc2f6b12d7b01fb585b7d36eb862ac580171a6e850b67b6b50fb5cc

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdac4c65b8455e5ca6586a40647c1db6_JaffaCakes118.exe
Size

4.0MB
MD5

fdac4c65b8455e5ca6586a40647c1db6
SHA1

2af5c29a4595a178bcceb38b4fdd802e5faf8743
SHA256

2ab1caec6bc2f6b12d7b01fb585b7d36eb862ac580171a6e850b67b6b50fb5cc
SHA512

33281f0ab6157951fd3c5b1a151546946952cb4e5b423b7765b278181ca8d1c1709ae1927e032843a150d78202c13ce8ddd93485110c1df2e6999f2d9b2f39fd
SSDEEP

12288:RP0uhyQ8eJLqXDOjtvh434yNnk5hVFJFar+xCcHKEC0Qcs7Lao3IM:ZRF84CDOVh4jmhVFJqcqaQD7Lag

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdac4c65b8455e5ca6586a40647c1db6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fdac4c65b8455e5ca6586a40647c1db6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdac4c65b8455e5ca6586a40647c1db6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4248,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-0-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4028-2-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4028-1-0x0000000000400000-0x000000000080C000-memory.dmp

Filesize
4.0MB

Download