08a21708d6f599bfbcb69780ee5d8d657cdac26dd2861701e833969006e07f0e

Analysis

max time kernel
96s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 22:21

Target

JaffaCakes118_08a21708d6f599bfbcb69780ee5d8d657cdac26dd2861701e833969006e07f0e.exe
Size

188KB
MD5

50bd7e456e29d1e3a796115a0bb6aadc
SHA1

738927569f923d936f27b04d48ffc556ab4601b0
SHA256

08a21708d6f599bfbcb69780ee5d8d657cdac26dd2861701e833969006e07f0e
SHA512

2f7306953d80844c89ce7ea35da260fa7405ff8053bd792dc133f20752c34aa6a065a1a0db03899bd1459849a58fb7878d701dac64b975fa0724952036c3a274
SSDEEP

3072:nm0Nku3743XN3/lkmQwqkn5/QKSjl/A6Ql4zJBOfZiAoAixlhaGl/:zCB/a7wqkn5/QKSRA6u4zXoiVM4

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_08a21708d6f599bfbcb69780ee5d8d657cdac26dd2861701e833969006e07f0e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3532	JaffaCakes118_08a21708d6f599bfbcb69780ee5d8d657cdac26dd2861701e833969006e07f0e.exe
3532	JaffaCakes118_08a21708d6f599bfbcb69780ee5d8d657cdac26dd2861701e833969006e07f0e.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3532-0-0x0000000000B30000-0x0000000000E7A000-memory.dmp

Filesize
3.3MB

Download
memory/3532-1-0x0000000000B30000-0x0000000000E7A000-memory.dmp

Filesize
3.3MB

Download