6284579fffc8bf3383d63160e1963af087b1e7e536dff035667df05e8305f79f

Analysis

max time kernel
138s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

535364ddcdf1766b974902a39c6763df_JaffaCakes118.exe
Size

244KB
MD5

535364ddcdf1766b974902a39c6763df
SHA1

67aa3028a294f8a1e2545ec50494be4ae9e6e989
SHA256

6284579fffc8bf3383d63160e1963af087b1e7e536dff035667df05e8305f79f
SHA512

3f2822a57e22a4c6347ab09de17e2f37de12aecdf2062edd5f0e9c82aa1bf913029f45b86a3d9aaa57d5d071c95d5f7ac3e4759c6ac7e911b59fbb8d2c831b28
SSDEEP

6144:K/na4kTcJwujfYwF2imiqn8UOK7V+J5/Fah+cZbtDI9uV:yna9TcJwLO2inUOK8JNUoyhc9uV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	535364ddcdf1766b974902a39c6763df_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\535364ddcdf1766b974902a39c6763df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\535364ddcdf1766b974902a39c6763df_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5096-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5096-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/5096-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download