b8822db4c71c844e435260d606e71423a653c6fe9eba3ba7021bbd855fdc7b16

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b2ee239bd8ceda7cdb6f82d2bab1a3f_JaffaCakes118.exe
Size

45KB
MD5

8b2ee239bd8ceda7cdb6f82d2bab1a3f
SHA1

55bfa47c46071e290146ef95842b7a2758c59947
SHA256

b8822db4c71c844e435260d606e71423a653c6fe9eba3ba7021bbd855fdc7b16
SHA512

016cb29be72d12feed8245b2b13b8d8e8cb687f6e2b419e7668e98e8fb266b0609e52822f512955aed1fb5af1bfcbbecdaed707cb54f643dc99929f23d76d538
SSDEEP

768:utDqJ4uCEMBegwCYrIemIZEeLPkOABMn+ayzw6xlq5:uVI4f3VwCQI+ZEy8OABMntyzo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b2ee239bd8ceda7cdb6f82d2bab1a3f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8b2ee239bd8ceda7cdb6f82d2bab1a3f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8b2ee239bd8ceda7cdb6f82d2bab1a3f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...