908afe6a3acf969b42226a779752087885dc339fc4980e96d85694d3069574c0

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

789f7dc1d5a1f4c3e40a1a14e048a906_JaffaCakes118.exe
Size

180KB
MD5

789f7dc1d5a1f4c3e40a1a14e048a906
SHA1

7450d4d0459b04fb2da15ae2c83c840feec2694d
SHA256

908afe6a3acf969b42226a779752087885dc339fc4980e96d85694d3069574c0
SHA512

694d1e795d9ce729fb6287a41afde09d6e0b6a81e6e762e17bdb1802bd6bb2a0d58ebec132ed3ad60c7d5acf215f02ac318201921c6c1573a0e1c15f9e4f8c57
SSDEEP

3072:XFK3eDBX0iItHBXhvtd2qElDi8RKgIDc6fyq4QLp7QRuLTwoE:XFwGD5Ryk1uwo

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3164	4836	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	789f7dc1d5a1f4c3e40a1a14e048a906_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\789f7dc1d5a1f4c3e40a1a14e048a906_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\789f7dc1d5a1f4c3e40a1a14e048a906_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 224
  2⤵
  - Program crash
  PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4836 -ip 4836
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads