852fe7fa86dab04d789b1bdbd8c7add5e27bf32c97a468436e659cdad1803d40

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

456caa610bf29bc3d79fda50b6a8cab4_JaffaCakes118.exe
Size

67KB
MD5

456caa610bf29bc3d79fda50b6a8cab4
SHA1

61d4f682eab2b1f65d195ccdfca58e64d11eecbf
SHA256

852fe7fa86dab04d789b1bdbd8c7add5e27bf32c97a468436e659cdad1803d40
SHA512

84bc910275533d2796501c7abbab2a73df5ac6fe969f857a44b5196e2df824f6a66e1af23e029497cd5fa19aae574649d95ac097b6c64ab889b2853555864d5d
SSDEEP

1536:h/vsW0WkWHVwZMi2l/3IPAMQI76TJU7m7:h1t9HVGVWaOI76dU7m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	456caa610bf29bc3d79fda50b6a8cab4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\456caa610bf29bc3d79fda50b6a8cab4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\456caa610bf29bc3d79fda50b6a8cab4_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads