f2a0fb8fd3a4e4bf5aaeda4fa4be5a1a86afa32eb9fb09593039e1652ac9e741

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7592c909cd7b0f1a90c12bb837300373_JaffaCakes118.exe
Size

41KB
MD5

7592c909cd7b0f1a90c12bb837300373
SHA1

76e7b089db1307e34c745fe41c69c2ac548af08e
SHA256

f2a0fb8fd3a4e4bf5aaeda4fa4be5a1a86afa32eb9fb09593039e1652ac9e741
SHA512

a30f0828bea9e1b165327f796543ffea74b760753b0d233456516026b36766b7d08fcc2fc10f575f3c92a84cc54b16b3bb47d5f951f4baaf4a130c6f05016445
SSDEEP

768:wlrKLD4aK5jBuo8pZhZSbQVUlLJE9tbb7IT:N4aKV4THhZSbQVUlLJmbHIT

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4476	1344	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7592c909cd7b0f1a90c12bb837300373_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7592c909cd7b0f1a90c12bb837300373_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7592c909cd7b0f1a90c12bb837300373_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 272
  2⤵
  - Program crash
  PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1344 -ip 1344
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads