0998f9c35b35f180618c52d33315d53ec0ac543f522b5e5e639655c750577c53

Analysis

max time kernel
139s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

556d75dce8a2ecbc4008cdf398026a99_JaffaCakes118.exe
Size

578KB
MD5

556d75dce8a2ecbc4008cdf398026a99
SHA1

9fd1327c9e9cb308f972158c883123e079547f9a
SHA256

0998f9c35b35f180618c52d33315d53ec0ac543f522b5e5e639655c750577c53
SHA512

0132ad007090c2d6e73379ea2b3aa471568cc688bdde5732c5b807cd0ea045ce1849b7ad1cc4fee3fd18162dfff5351bbf5ba7449648fe4cf79218112013ea3b
SSDEEP

6144:w1/cNhRVQyr7TQe236oOd/xMqSlJ7M2edPMwJijXgnHcz3ZQO5ERpFQlrHvyCOMV:w4hHQyDL2KVSn7MvJi7QvQtKCOlrZVfo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	556d75dce8a2ecbc4008cdf398026a99_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\556d75dce8a2ecbc4008cdf398026a99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\556d75dce8a2ecbc4008cdf398026a99_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-0-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download