a2115bdc5a9f2b15d4326f9c66ddf1d8b499f1e885e714d680a71220a78115db

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4226f312925fb5e29bb3d3571ee2a672_JaffaCakes118.exe
Size

270KB
MD5

4226f312925fb5e29bb3d3571ee2a672
SHA1

730679f1f0ece670eba1e572fee09ab46d087f5c
SHA256

a2115bdc5a9f2b15d4326f9c66ddf1d8b499f1e885e714d680a71220a78115db
SHA512

5997d3ad26fe62801c7927180b167c82f54eb6e403ba8b7c5a4c74dabec7a276b1c6089fca38574e98edadc48e788b9274a21e3fff8f41a0c7873740a6b2e88b
SSDEEP

3072:c/5uSzutblibTcQ7Y+2aGPkXB8Ko/btQtHevzY:+pqUbTcQ7WaGMe18

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4226f312925fb5e29bb3d3571ee2a672_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4226f312925fb5e29bb3d3571ee2a672_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4226f312925fb5e29bb3d3571ee2a672_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\boot.pid

Filesize
60B

MD5
1d9ad12cf11e30436acf668d4c0185c4

SHA1
0801b7c2bc69a9c356cef0f2cb82e59590aa42ea

SHA256
7caccbef5d08840a9e64fc674c7c487e145c103271a151b8319f43a2b4fe320b

SHA512
e193b11cc6b1d69bc0a896c549bb43570317c0b1f5cdb6798017be2485e6a5cc7974fd103b73c4d599cca26eb6bd0cf683a43dbfee3a0310f853d8956d215a07

Download Submit
memory/3252-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3252-688-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download