8f094952ed2bfe4dc76952faedd0069cb7fdf0cdb3e99d83f596ab1490bea9b1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7254f995d04da951e4bc3159fa40c47b_JaffaCakes118.exe
Size

24KB
MD5

7254f995d04da951e4bc3159fa40c47b
SHA1

f1c746f5fd0d5604044365d50ac1c07a06bf1078
SHA256

8f094952ed2bfe4dc76952faedd0069cb7fdf0cdb3e99d83f596ab1490bea9b1
SHA512

ba2c4c5d445cc51f23f3c08701b6d7162f84c4077de4602861b0f2baff22122ffd066f0a0f02134dcbb187da6caa4101794701d9360043b71302a6684879453f
SSDEEP

384:FhicGo8diy9KLvD38bxc1inSLF2tzTz76hgcRk4l1fonfqpu45:F69KLb4cwSh2c1f0So45

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	1600	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7254f995d04da951e4bc3159fa40c47b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7254f995d04da951e4bc3159fa40c47b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7254f995d04da951e4bc3159fa40c47b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 264
  2⤵
  - Program crash
  PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1600 -ip 1600
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1600-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download