f8bc1638ec3b04412f708233e8586e1d91f18f6715d68cba1a491d4a7f457da0

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2024 17:07

Target

7d3f19b760cb1958a2c4d9ca7492c406_JaffaCakes118.exe
Size

376KB
MD5

7d3f19b760cb1958a2c4d9ca7492c406
SHA1

c3fa91438850c88c81c0712204a273e382d8fa7b
SHA256

f8bc1638ec3b04412f708233e8586e1d91f18f6715d68cba1a491d4a7f457da0
SHA512

64d14a7a3866c76d45bea7bee19d40f63241c777d8d259a8a79279cac51396fe9469f28fc68eaa8ab688af13a47c4c5af0d62005d93a4649f81e411b8f2eae91
SSDEEP

6144:jwHqh+1uu3RVmPY55eExdAev5wuSiRqAO1iNgLTBs4LhVJqRcelLQMo8:P+1uu3RVmPYaad5wuSiRqLNeRcZMo8

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

7d3f19b760cb1958a2c4d9ca7492c406_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d3f19b760cb1958a2c4d9ca7492c406_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d3f19b760cb1958a2c4d9ca7492c406_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7d3f19b760cb1958a2c4d9ca7492c406_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7d3f19b760cb1958a2c4d9ca7492c406_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4280

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact