c7aef35fbe33d83760949090edae325c97a3e409fb8dce40a6b341489965e258

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

71b83c8a15a1115aa78dac84195b2139_JaffaCakes118.exe
Size

1.8MB
MD5

71b83c8a15a1115aa78dac84195b2139
SHA1

a02b057e0426ed84146545671cf1f15aa4b7e9a4
SHA256

c7aef35fbe33d83760949090edae325c97a3e409fb8dce40a6b341489965e258
SHA512

085c764226ed05d21492339db1cf35548aba2fdbf2acc79920d5c55cd38e4171606807c0f92442b77830a0ad613ca40734e0013beaae7a20b1536740a01ce01a
SSDEEP

49152:PVHFXSFEmqiDqCbS1gickVsPTpuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuTuuu5:PVHFXSCmqsSgfkVsNuuuuuuuuuuuuuuJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71b83c8a15a1115aa78dac84195b2139_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	71b83c8a15a1115aa78dac84195b2139_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	71b83c8a15a1115aa78dac84195b2139_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\71b83c8a15a1115aa78dac84195b2139_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\71b83c8a15a1115aa78dac84195b2139_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads