Analysis
-
max time kernel
96s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 22:54
Behavioral task
behavioral1
Sample
JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe
-
Size
188KB
-
MD5
86c4c5dae3465105a298c02d1fb1b1ef
-
SHA1
8fda5bdce3b92e4d38e543cbce92fd5d96b57357
-
SHA256
1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f
-
SHA512
c863e8ac917c9a35bf5c0f2b31bcf068274aca1eadbe95d6f39478f1868c94320f5e315eca5f155e6a05adc4efe6c23ae5470fca4941b5c1b776c04757af1db3
-
SSDEEP
3072:ZSAE+Fg0yKz1d3Fm1pm4SoaZFbV+TFFB+/NpbogDPQTl6I/IWYSAPm5wC:n1RFupm4RaZFbVOzA/N5inj55
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 636 JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe 636 JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eceb12eb0a747b02a89e257f10c130fae1d2d1cdbb6c30b841fe11d18bae36f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:636