cba078128be9defe6f5aa92c571cb6c2bea91f00bfa740f4a5a10da22f53fb13

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2f4d61d0fae3b3374831c2bb77dc4aca_JaffaCakes118.exe
Size

220KB
MD5

2f4d61d0fae3b3374831c2bb77dc4aca
SHA1

30f74496ffa4d0e3eac961a4fa002cd1f22f0a47
SHA256

cba078128be9defe6f5aa92c571cb6c2bea91f00bfa740f4a5a10da22f53fb13
SHA512

79a7768bb3f0a4fd6b95a5e1ed7dfe972a18894cbbe43e3dc8e647bc68e51f6af2443b20cd9883d082f1f6392f70ad1b65f845f31f6dca079ab4afc2f0218d23
SSDEEP

6144:iP08sD7x7LX0k1LAa1cF0zmrI3Jqu1Bbeh:iPBAFE0Zh3ouW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f4d61d0fae3b3374831c2bb77dc4aca_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2f4d61d0fae3b3374831c2bb77dc4aca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f4d61d0fae3b3374831c2bb77dc4aca_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-0-0x00000000001D0000-0x00000000001FF000-memory.dmp

Filesize
188KB

Download
memory/2708-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2708-2-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2708-3-0x00000000001D0000-0x00000000001FF000-memory.dmp

Filesize
188KB

Download