3345348ad8109cbef2493237c21ad27f453b21c99ddadfc5f0482618083cd4b4

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13d9d3e8a20c27ab7b4fe3b6f05ba094_JaffaCakes118.exe
Size

252KB
MD5

13d9d3e8a20c27ab7b4fe3b6f05ba094
SHA1

68e8c7ac3c9efd64781f7be2b0630b6e972829b4
SHA256

3345348ad8109cbef2493237c21ad27f453b21c99ddadfc5f0482618083cd4b4
SHA512

3ffb212efac6dd8c7e9e9af10eb2f0e717bf88f2d89e5ad95da297d0d05c2ef1918cf810e1a14c36a76aef95fe6dcae10f34447ae0433a4e0fdb11b96dad785d
SSDEEP

6144:MKSOzBggYF5WhU/VU46BADj2BDHjBYaaC:MyBgg6eKd6iH2BHBYDC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13d9d3e8a20c27ab7b4fe3b6f05ba094_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\13d9d3e8a20c27ab7b4fe3b6f05ba094_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13d9d3e8a20c27ab7b4fe3b6f05ba094_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\setupcfg.ini

Filesize
120B

MD5
01f8096120de9d2c643de421ef8ed363

SHA1
f099b705ba90be9be0cea97a138604a5dae7ae12

SHA256
4fba4da7b8c5ad78f40f7c499f09f54950b0c11500eeeb11ff6291e499100716

SHA512
3a8a2896dcb217f1c539326e956e05dea6703bf55899ccce01ac19db6169a192bc782a937a4ff0ceff33c1133b47b8cd6b672240f86411e2d18010c2ed3a956c

Download Submit
memory/1408-5-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1408-7-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download