018f2ec79121f67d04fbee3c83abcd0bb00d799425dc0c875edeecbf4a5443fa

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 06:29

Target

84def8c0d874ff5463d8935cf738ca3e_JaffaCakes118.exe
Size

64KB
MD5

84def8c0d874ff5463d8935cf738ca3e
SHA1

13d6abbbfb8bcdf740da1158cf99c8307f02501d
SHA256

018f2ec79121f67d04fbee3c83abcd0bb00d799425dc0c875edeecbf4a5443fa
SHA512

f7616c72dbb650a63d046c748c1a93bf1b2d9ca07afcde84d68e64dc9a85e63e6486a391700fb0a21ac0e2365cb4bbfb28ba9fe2000b90c3c0c9b02e10f6d122
SSDEEP

384:1kcwps7+cDJyqFRgROYpNcWPtkywTS3hGrdnaKDvongJMSIIW+uW0sub6CMVCm:Gcis7fvRrWFV/GrdnHDgYnIENCMV

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

84def8c0d874ff5463d8935cf738ca3e_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84def8c0d874ff5463d8935cf738ca3e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84def8c0d874ff5463d8935cf738ca3e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\84def8c0d874ff5463d8935cf738ca3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84def8c0d874ff5463d8935cf738ca3e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4572

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact