c5a1cb54d850012529c795929643a65fca42e8ceb01053e8a7cb52338046ff3c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fe0557255b2e905cb601dbd20857907_JaffaCakes118.exe
Size

559KB
MD5

3fe0557255b2e905cb601dbd20857907
SHA1

f101070df02e4db23becb25f4c1d3895855d159a
SHA256

c5a1cb54d850012529c795929643a65fca42e8ceb01053e8a7cb52338046ff3c
SHA512

396ed2f9c1e7c7d96264f956478936a80f356012105d8ca11e1c3ce9a4ab45d4e8cc7b4e0217252f53d1b01ede7ec28fcd27b9746feedd93097110302e6b69c7
SSDEEP

12288:dRx9b2NFyk6zLyCiDCyei0U3z5V1usbZ8NSh/ri:JxDLyCWCyeihVV1b6Gri

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3fe0557255b2e905cb601dbd20857907_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3fe0557255b2e905cb601dbd20857907_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fe0557255b2e905cb601dbd20857907_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...