6df7619e359537879077dbd8cf2e720368c34cf35b61f25550565c517d9d3eed

Analysis

max time kernel
140s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30c8e838fcd19e62d7e190bdf7def3e1_JaffaCakes118.exe
Size

1.5MB
MD5

30c8e838fcd19e62d7e190bdf7def3e1
SHA1

678fca0d93c923b572898fb3af312bc1e6ca7e55
SHA256

6df7619e359537879077dbd8cf2e720368c34cf35b61f25550565c517d9d3eed
SHA512

d1b02aa5f0f5fce845a3036796ac38a39bbe70acd94d512f01462a648b2a1c5e1e9e213b2e9c69462652836413df9481599ff59d58799244e9303245240865c3
SSDEEP

24576:pVObYsW38Mr3HKBHHK6psh8P87iAriLhWtIAUy1C3xDu9HZq8dYNdSzqt96:pVOfWN2pFG+ygBOI0YNdS2C

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30c8e838fcd19e62d7e190bdf7def3e1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\30c8e838fcd19e62d7e190bdf7def3e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30c8e838fcd19e62d7e190bdf7def3e1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-0-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/344-2-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/344-1-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/344-3-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download