b54d0288deb94bdb69d9a49c4a1447b42ef900110f1ce56be8f2b5b186ee320d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03fa95f5c9e7ea1c05b3d1b09bdc3f83_JaffaCakes118.exe
Size

42KB
MD5

03fa95f5c9e7ea1c05b3d1b09bdc3f83
SHA1

31e25b2aaeb618c9bec6c44d5c2bd2e5bc731593
SHA256

b54d0288deb94bdb69d9a49c4a1447b42ef900110f1ce56be8f2b5b186ee320d
SHA512

86846cd2e62a8f2e25728d7aec9e973fbb2616bbd248348cc3bfb1717abdbfeab096cc22e1b4d8d6d1b7db71c25670140e42c9c966e9a0edbeb12922972ddafe
SSDEEP

768:J8CRkkSUZh719LQfL4jSeo7RKDJ4v1PbUbUxugv:J8CjBRLQfcjSeiRBvlbpf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03fa95f5c9e7ea1c05b3d1b09bdc3f83_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\03fa95f5c9e7ea1c05b3d1b09bdc3f83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03fa95f5c9e7ea1c05b3d1b09bdc3f83_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...