68f5819687e8f410dea315f32cd04e33ca7c3ec62e9bb9bae9e03b5ded29970e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 12:28

Target

e4c5fe637b0ad8b28c195c3f04f40a40_JaffaCakes118.exe
Size

108KB
MD5

e4c5fe637b0ad8b28c195c3f04f40a40
SHA1

df2e3a758231e404d21fdc33c5f3e413a37a49c6
SHA256

68f5819687e8f410dea315f32cd04e33ca7c3ec62e9bb9bae9e03b5ded29970e
SHA512

4218ea9500e5327ce9a50781075f64ee6575898265084b1c14078956a000c56d223809843d75757dc7be4cd56ed294da0fdb48ca1d4a39ff8d761b0562914d41
SSDEEP

3072:lKqvGG2v9BmUhzD/jTZSRxUcJpNp3RVNde/x6iAwmle:hvGG+rhzDQRdeawX

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

e4c5fe637b0ad8b28c195c3f04f40a40_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4c5fe637b0ad8b28c195c3f04f40a40_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4c5fe637b0ad8b28c195c3f04f40a40_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e4c5fe637b0ad8b28c195c3f04f40a40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4c5fe637b0ad8b28c195c3f04f40a40_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1872

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact