39ea1b018c85c0a8db608dd09ad57db5b517b5fcab91f506e096c46b7f1f84a3

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 20:04

Target

8774b49e130ec6618278ea017c7e9490_JaffaCakes118.exe
Size

2.1MB
MD5

8774b49e130ec6618278ea017c7e9490
SHA1

bc6f6689e2a7532355cd2277a1d934419b0df5c2
SHA256

39ea1b018c85c0a8db608dd09ad57db5b517b5fcab91f506e096c46b7f1f84a3
SHA512

64c5fbf35f39417805f4d59566e0303bfd8ac0fd08d4435f5f79c69f8da81da0c8a629df399ed488ce1ef68c486b253e0af83ad65a15f3231dff4ae6b1ce7776
SSDEEP

24576:XAf0BGYBYeMjvTxcgkive8mVcCftJQmal3juQ55313N:XAUSwaCffMl3F

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

8774b49e130ec6618278ea017c7e9490_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8774b49e130ec6618278ea017c7e9490_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8774b49e130ec6618278ea017c7e9490_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8774b49e130ec6618278ea017c7e9490_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8774b49e130ec6618278ea017c7e9490_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2816

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact