421c2a1ce02d54d9c36381240c8b506d016259bc23ca0b501118ddaac25bfd34

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2024, 23:50

Target

JaffaCakes118_421c2a1ce02d54d9c36381240c8b506d016259bc23ca0b501118ddaac25bfd34.exe
Size

188KB
MD5

439a723b2b7fedf66c0ebc6909c50ccb
SHA1

6f6548a654f9aa646cc0e9edf8e2601fc7792784
SHA256

421c2a1ce02d54d9c36381240c8b506d016259bc23ca0b501118ddaac25bfd34
SHA512

31dce48bb8cbe90849a80b41862a4886e74c8e77368a676de0c0de1306a90b0866ac6dcb0f9915557daa314becd871e5605b45c4778c4b378c57642b769aeb04
SSDEEP

3072:z2MvBkKF1wvzJ93ikcMZ9Xa26zNUVsMdEJjuSOVqRgcanfv1tfGHo06nBIw:nmxilMZta26zmVVVEZGGI067

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_421c2a1ce02d54d9c36381240c8b506d016259bc23ca0b501118ddaac25bfd34.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	JaffaCakes118_421c2a1ce02d54d9c36381240c8b506d016259bc23ca0b501118ddaac25bfd34.exe
2004	JaffaCakes118_421c2a1ce02d54d9c36381240c8b506d016259bc23ca0b501118ddaac25bfd34.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2004-0-0x0000000001850000-0x0000000001B9A000-memory.dmp

Filesize
3.3MB

Download
memory/2004-1-0x0000000001850000-0x0000000001B9A000-memory.dmp

Filesize
3.3MB

Download