37dc97499848231687b2e227f03d71d4d277218f44b525de2efd6a98cf16543f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4d05ba358d48e8468628fec855b0dd7_JaffaCakes118.exe
Size

11KB
MD5

d4d05ba358d48e8468628fec855b0dd7
SHA1

14f9d5ae45ab5f471a6fff6c97ecda79e98f7c0d
SHA256

37dc97499848231687b2e227f03d71d4d277218f44b525de2efd6a98cf16543f
SHA512

81f44a7760c128599e9303f49d4bf5b8b9ef01bc0350c3d59992bd08e7df56ab2545ad46a9b6dc908d8eb4b3995838971536d3db1927b5efd9a5937266364643
SSDEEP

192:BykdHIijKePASvs/R6NJUkBBctF3Uc09qbR:Dd4Svs/R6NCD8c09K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4d05ba358d48e8468628fec855b0dd7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d4d05ba358d48e8468628fec855b0dd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4d05ba358d48e8468628fec855b0dd7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...