f52e1826c98199716fe22bad6d705be6e432c0fe3c6af169cc3eaa3c9cc6567e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2aa1a03a763af66abc3bcd8e6424f6cb_JaffaCakes118.exe
Size

2KB
MD5

2aa1a03a763af66abc3bcd8e6424f6cb
SHA1

50bf4d9b7ddaf8fddfeb9c0980d89cf8416c41f8
SHA256

f52e1826c98199716fe22bad6d705be6e432c0fe3c6af169cc3eaa3c9cc6567e
SHA512

598e0fe36784b283d37ca031bb6996bbcbeaa5cd584ae7b197341848d7759cfe5d5e7fc9ca57a1e7b71c5069e39aa1f8e7ec4ebf33aad646eac26cfc6b4172f2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aa1a03a763af66abc3bcd8e6424f6cb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2aa1a03a763af66abc3bcd8e6424f6cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2aa1a03a763af66abc3bcd8e6424f6cb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2656-1-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download