306b7c249e06e3198fccd72d2bda84de59387070f9315707d94628e25fcdcdeb

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe
Size

3.1MB
MD5

8c925e7728c05012605ae9b606bb1680
SHA1

a431757f1b68265dce504b8727b2a570cd8f8e78
SHA256

306b7c249e06e3198fccd72d2bda84de59387070f9315707d94628e25fcdcdeb
SHA512

126814bdeb361ae09202ab7142f11ab104d4ab1f92d0c6a312d895585efbcf7e9ba7730df8073901ca87572fbe9e33209b0b535b9c950c7f7dbf932170551dae
SSDEEP

24576:UL69HiIC60SNTze/bj8NYbVYnoXx8hgGb+HqTwX2CAHxF9v8ms3e:Ni80Stze/bjPYss7qcC8h9T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-0-0x0000000000400000-0x00000000007B1000-memory.dmp

Filesize
3.7MB

Download
memory/5044-1-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/5044-2-0x0000000000C80000-0x0000000000D67000-memory.dmp

Filesize
924KB

Download
memory/5044-3-0x0000000000400000-0x00000000007B1000-memory.dmp

Filesize
3.7MB

Download
memory/5044-4-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download