e658b93a28ba62aab7821039f7196e395e92876549e0f2aabea4f51ae1540e75

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

902d1a02d37e3a7747d77428391f1323_JaffaCakes118.exe
Size

927KB
MD5

902d1a02d37e3a7747d77428391f1323
SHA1

d5dd1c2e8ec2dc4d662126f04f72ddd01f117bef
SHA256

e658b93a28ba62aab7821039f7196e395e92876549e0f2aabea4f51ae1540e75
SHA512

324e190f695c9a9841727e4fb25e9f12f804209837513e95e6e6d70dae3e15c4b7113c43f5bd5b705bed95f65c65ad0d06775570500bdae326f6f34d681bfabf
SSDEEP

12288:VF3/6Yusjh3yaNIUl4IrgtNSjyxl2LJD9q8DDo5NoaD0FJXFmiO9ojVf4Vd:T3/6YHByaiU3k28lWnqokkaDiJ1XO0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

902d1a02d37e3a7747d77428391f1323_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 902d1a02d37e3a7747d77428391f1323_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	902d1a02d37e3a7747d77428391f1323_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\902d1a02d37e3a7747d77428391f1323_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\902d1a02d37e3a7747d77428391f1323_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2944-1-0x0000000002510000-0x00000000026AE000-memory.dmp

Filesize
1.6MB

Download
memory/2944-0-0x0000000002470000-0x000000000250D000-memory.dmp

Filesize
628KB

Download