b07dea2c9801cb0ab108596aab419060625751e7f983d9892ed46b8cba1761ae

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3904bb48c7561446c525616613f10c80_JaffaCakes118.exe
Size

1.2MB
MD5

3904bb48c7561446c525616613f10c80
SHA1

2543dcb5bc80e53479bab8f1919248c9afa85bc3
SHA256

b07dea2c9801cb0ab108596aab419060625751e7f983d9892ed46b8cba1761ae
SHA512

aa5fd3a42dcc6fca14ab285b9531dc53e51e668a9f219e30402e2ac9753b66db7fecee06eebb11c5b5b4b0179d66976df27722cb556cf3fc0be9d822f6a81c75
SSDEEP

24576:xkeLHX/eL2cL93q7zmUtypmoY6GvHcy+hykuug:xZbX/8HYYYxv+h2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3904bb48c7561446c525616613f10c80_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3904bb48c7561446c525616613f10c80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3904bb48c7561446c525616613f10c80_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...