78a521626d61db78457f3ef08563d8411fd5b8970539f47d9756947e37a85a7d

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e2e9b584abca49b4c81b4f350e25e11_JaffaCakes118.exe
Size

505KB
MD5

3e2e9b584abca49b4c81b4f350e25e11
SHA1

1978fb9d336001f0e72277b6b5b366a41268aebf
SHA256

78a521626d61db78457f3ef08563d8411fd5b8970539f47d9756947e37a85a7d
SHA512

5e26a665802da257441bd2b90a175bc094ed2305e66d70d649f4a52c9ec9e7ba4ae41ba9ad22a0d741c062a181121c5b1ea288625279755e8c56c9ddda033b80
SSDEEP

6144:5KSeyKhHTu7mAWDxQxnpxBSkJeF3P+UW5H/HYmMPdavmjpdjk87tbE29Gr:wSey8AcOxplJexI5HrOd5bEZr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e2e9b584abca49b4c81b4f350e25e11_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e2e9b584abca49b4c81b4f350e25e11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e2e9b584abca49b4c81b4f350e25e11_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hex.ini

Filesize
87B

MD5
f92cf3420999bec2e920284ffff1549c

SHA1
ee99cc2b2648e1ff51ccc793213f784efa5ffa19

SHA256
20ac5da84153e9ed82c460ec2ea2a32f132e56f8b3c3fffdb943b4630219fafd

SHA512
589823da4e7fdfb45c140d84a583cd49ce809e8a7b207e0fc87f2be0de0f28c6cd09b1eb554e1cdcb03a7c14110d2f1cd25b2dc883aca3bdd2630d2bd02c0a22

Download Submit
memory/3088-9-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download