Analysis
-
max time kernel
93s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2024 22:57
Behavioral task
behavioral1
Sample
JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe
-
Size
188KB
-
MD5
11a91d49b8b133601d822536885c177d
-
SHA1
b3e659d6745f135c2ea35ef89a0dbac5b1f899d8
-
SHA256
b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3
-
SHA512
9f6ae8bb238e395d88f0c827aaf42f39ba8f27d37135a4260ad9d0a7847b1b5d032bb86f34ef122baf1f63f5e3745a241be9dc4ccbb1a0d0e9f50696ff778afb
-
SSDEEP
3072:Bu6WktJBF4Ps3O59226QbJjSaTxmkNe6+Mqz2ZNMLOuX:X+iODH6QbJj/xmkWs
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4892 JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe 4892 JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b29a209d550af0838d362ecd1b734eaf684b46086eaaa1b786a7238a91d1e3f3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4892