8f353a1e10fb465e8fb9f120a1cd96d72207f61839618ce27dca889761c52485

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97326a1f2d381f11e382b39778cbfcc7_JaffaCakes118.exe
Size

88KB
MD5

97326a1f2d381f11e382b39778cbfcc7
SHA1

e0d3857b3efa7d7e84e2a9455516f469079965ff
SHA256

8f353a1e10fb465e8fb9f120a1cd96d72207f61839618ce27dca889761c52485
SHA512

1832e7eb42fd5d32f02e052c41ae2d1ae4882f91267e703d58b1dacb84547a58a591fc1f2aed0557975bfe8caca9e4fc880ef7d3bad896a4ac9b67419a378c3f
SSDEEP

1536:spqNpqFQjWb/rcXaKEWYDF6cgOV3N8sUeUU/x:c0WTraaKPYDwPiN8sOkx

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	4624	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97326a1f2d381f11e382b39778cbfcc7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\97326a1f2d381f11e382b39778cbfcc7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\97326a1f2d381f11e382b39778cbfcc7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 232
  2⤵
  - Program crash
  PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4624 -ip 4624
1⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...