b0c0864763844b1fd382f7981a51294da386bcf06903e581bbda86d89e6f3430

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11ed4fff3e1b733f1ef7ea021792c146_JaffaCakes118.exe
Size

73KB
MD5

11ed4fff3e1b733f1ef7ea021792c146
SHA1

133c071ebbc634145a7c56880fa329162aa56fe7
SHA256

b0c0864763844b1fd382f7981a51294da386bcf06903e581bbda86d89e6f3430
SHA512

82fd1261b14ecfe4effeef4a2bc87832bb768863d75a8328a9beed859ee22da3f4358c4be45b73416063a8b6542152fd51dd49b550d0ac475f428c886c781f27
SSDEEP

1536:CFQGgXOgQMnkp0KMQUCQDnhVp9QmBE81ictL:CFQGgbpnMZMQUCQDnzpami83L

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11ed4fff3e1b733f1ef7ea021792c146_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\11ed4fff3e1b733f1ef7ea021792c146_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11ed4fff3e1b733f1ef7ea021792c146_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download