b5d5cf9777b3c6705e774f997ee8daa869e2434c13687ab1ea839a977e81768d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_249d342857ddec5406ae2cab1042d552.exe
Size

243KB
MD5

249d342857ddec5406ae2cab1042d552
SHA1

fa6e58ae5e74d310167e79f501f424a4e946ba44
SHA256

b5d5cf9777b3c6705e774f997ee8daa869e2434c13687ab1ea839a977e81768d
SHA512

ecdf5c6308c4925857a9996e8dce59302eb375f867bb167ef94a60094808ee4be9b293a20f03762592ae02d9dfbcba0103f2a249a05287eb22c401f1dc0641d7
SSDEEP

6144:5nScTKd/ASzisjWzxCyEBQFyTrfdiaXuQtqc7YKqkYh:/TKCS2sjWC1rfd/Rtqc7HqkYh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_249d342857ddec5406ae2cab1042d552.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_249d342857ddec5406ae2cab1042d552.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_249d342857ddec5406ae2cab1042d552.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download