9ad3c818cf1aa624fff26c94eaaa1c568132cdbe96e733205eaebcbe1f0e8b3e

Analysis

max time kernel
94s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe
Size

98KB
MD5

0d0a5297ac9102cedac7fa8704c44253
SHA1

0d7695c3bdeae4cf74bbc2fe6a0c9557ccdf0020
SHA256

9ad3c818cf1aa624fff26c94eaaa1c568132cdbe96e733205eaebcbe1f0e8b3e
SHA512

3863fcabc352525e6bc10842f1f6100ab5abfecc45ddbc9026755538299aa8525329e640b5cb81ee66cb45286fff4a57bf0d5b82be972112d39274efac571ad2
SSDEEP

1536:silZ9Q8HdjvbFLJWKotafEmjII1FGgL6MrfWwomjq8ojt4yhOUvwrOSUN9PXe:H/2SdjVctaB4SBbzojJhOUvwrhUN9PO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4224	4392	0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe	82
PID 4392 wrote to memory of 4224	4392	0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe	82
PID 4392 wrote to memory of 4224	4392	0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0d0a5297ac9102cedac7fa8704c44253_JaffaCakes118.exe" 8580469789917749700
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4224-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4224-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4392-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download