fe4c1a5c0e9a5f4de20e9530e8273b5035861e185a9b9f42f272cb5bc0ffd2e1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

822798a93c9f7fc4048dfbadc3a4ace1_JaffaCakes118.exe
Size

876KB
MD5

822798a93c9f7fc4048dfbadc3a4ace1
SHA1

03c9423d3bae71cc9cf0161f1552ad53d3cc60da
SHA256

fe4c1a5c0e9a5f4de20e9530e8273b5035861e185a9b9f42f272cb5bc0ffd2e1
SHA512

8fba852ed9108f91c71a26fdb0f8c10221361498f0ee782fc9031f1ac25f020e02fb87fba70da6dcffa39f3444d5e8f8ce92b421d96616848b5645b30b601404
SSDEEP

12288:lnMwmkr96kip7Om4wW1z70lf4UB0br2HXybuqRE8hKB:lMY56kMsjFbqHXyiqRoB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	822798a93c9f7fc4048dfbadc3a4ace1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\822798a93c9f7fc4048dfbadc3a4ace1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\822798a93c9f7fc4048dfbadc3a4ace1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...