e8616f4b03751340692da371a7dffacab205c86ff1c9b0d58ec785b70bf77ac3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b4adc067534224f8b28aaec9c8c1d14_JaffaCakes118.exe
Size

120KB
MD5

0b4adc067534224f8b28aaec9c8c1d14
SHA1

7f62da3cda07d3a976d405184ee097475050eded
SHA256

e8616f4b03751340692da371a7dffacab205c86ff1c9b0d58ec785b70bf77ac3
SHA512

5a0edc726be9f4f8966a730a1480ab631600b1d63d3f2d2aa1be8ce897ea89fcdd6bb6ece6aa42b3da1b648f77d27dd9db9e70d92cee6296976453ba8e1c7e4c
SSDEEP

1536:bKkUNPnAHYqNfG6ie9gx6ySakJDJQ5rZ+3Btl1xrakXHQP7xbPADZgZSII1mlugj:2vY5G6iowSJWZox2kXHQzVP1SI2+Txx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b4adc067534224f8b28aaec9c8c1d14_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0b4adc067534224f8b28aaec9c8c1d14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b4adc067534224f8b28aaec9c8c1d14_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...