26b9412fd0c0ecf176894d7ce3d043a3063883e530bd4cbadfa4a03976d3254f

Analysis

max time kernel
95s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fecc37336b30af843e0f3d520d1e1630_JaffaCakes118.exe
Size

349KB
MD5

fecc37336b30af843e0f3d520d1e1630
SHA1

11e1aa0cc9858a86744bb4aa751172aa2e79ff44
SHA256

26b9412fd0c0ecf176894d7ce3d043a3063883e530bd4cbadfa4a03976d3254f
SHA512

7d5f67b7755e66b965c6eba0073a72c07d5cd6b0191cf2c63d26a25e1f8446e01310a6857476396d52bc89ad75497567685b43be013508bc109891facec41cdd
SSDEEP

6144:zLRDs75c6SvCEEaVEYJZCdOzYv3gvbfshA:zLR417SnEa7Je4fX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fecc37336b30af843e0f3d520d1e1630_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fecc37336b30af843e0f3d520d1e1630_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fecc37336b30af843e0f3d520d1e1630_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2724-4-0x00000000006B0000-0x00000000007B0000-memory.dmp

Filesize
1024KB

Download