9aaf74d8d181c0d8229bfb2d3934e1995e606ef7b0ed13465613e16af13d4141

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:41

Target

084bb810ff9b963d256cc16b4a38ee63_JaffaCakes118.exe
Size

4.8MB
MD5

084bb810ff9b963d256cc16b4a38ee63
SHA1

23ecf9e19576017d1f12d8ece9505b23c7a05696
SHA256

9aaf74d8d181c0d8229bfb2d3934e1995e606ef7b0ed13465613e16af13d4141
SHA512

2675d5de3293c21506094fb465201c341b934be4a79516f2cafcf957cced5f7302c22ab8575ce96d706bdf2e80d0511256ea1799088deaddfc2496c21ce84543
SSDEEP

98304:mwUZg/otQ3G2To+ZPLE8+QiB//dPlpKjCghL7XvLTAFzEPt3FHSQF/V/4dWp:qZGp3GEZoPB//XpKjCcLjYFzEPDHSKtx

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	084bb810ff9b963d256cc16b4a38ee63_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	084bb810ff9b963d256cc16b4a38ee63_JaffaCakes118.exe
2748	084bb810ff9b963d256cc16b4a38ee63_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\popcfg2\files.cab

Filesize
4.6MB

MD5
19ff469481b6b923691ee800d5c86f59

SHA1
80f4f03ec4d00e472cf0d25a3b850ff9aa4bc44a

SHA256
eb4c73b0af65431bcdf2567baeba37f66d66b59deed8ff6c067d6d5aa53e02ea

SHA512
7897e9d7bf1953ecc0999b78dc0731dc153504004e786d0ba7b1c309c7c801efe5d15c8607d43efc231b6fe750dbf4ef7a8315a03ff44241d5ce109132b0663a

Download Submit