c48de5b61a93d5316312951dd319ec74195f73d579cfb59d23a5fc2e774846cb

Analysis

max time kernel
95s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc1509e971823d42ed587de844d56795_JaffaCakes118.exe
Size

119KB
MD5

fc1509e971823d42ed587de844d56795
SHA1

c0385f87d0d01b9581b8d299dc915b1d373ba34f
SHA256

c48de5b61a93d5316312951dd319ec74195f73d579cfb59d23a5fc2e774846cb
SHA512

3308b96c2c8fc11572af58c358a965367fa8343671d7f035fc35a7530df3b1bba53c492e6b95eceba582252bd386d5c12fbb38543f7315070ad1d1a108637c84
SSDEEP

1536:Hl8zbfIR7taQdTXuvxlDSOg/Tv3eHKCEijn3iS7xcPm5qitGt66B7nsaLGdhhhZG:OOlYlDSOuTfiLX7OPmJGt667nwjez

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc1509e971823d42ed587de844d56795_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc1509e971823d42ed587de844d56795_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc1509e971823d42ed587de844d56795_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...