a325bd8fc2ed6867826d1b4a6a19862a614f8db4bc394eaaef2c7583307e6b50

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08b8f5eedc5e30aba09deeb606d939d5_JaffaCakes118.exe
Size

232KB
MD5

08b8f5eedc5e30aba09deeb606d939d5
SHA1

11aba7a2b6117e0b772c97098cb8f8e7c54f20c6
SHA256

a325bd8fc2ed6867826d1b4a6a19862a614f8db4bc394eaaef2c7583307e6b50
SHA512

200e82800b30bb5d9c9fa4bd683410b872ddc4d376e2111d56975fd950be8432681b07607939b00dfa9c47144155f75f670f2cc79c0cad6c14024158cdfc1cce
SSDEEP

3072:1UyjAihAFKqKizXo6VrBqqk14JrHFsRqJ23qzbFJzwpVikYSjmEYP6illW8RnNHu:yZTcPiGCrHWqQqzjwPVmEVgVnNdU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08b8f5eedc5e30aba09deeb606d939d5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\08b8f5eedc5e30aba09deeb606d939d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08b8f5eedc5e30aba09deeb606d939d5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5012-0-0x00000000006D0000-0x0000000000706000-memory.dmp

Filesize
216KB

Download
memory/5012-1-0x0000000000710000-0x000000000074F000-memory.dmp

Filesize
252KB

Download
memory/5012-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5012-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5012-4-0x0000000000710000-0x000000000074F000-memory.dmp

Filesize
252KB

Download