0f1f188799ba937a8ae609e42325845d5fe23c0905f42d466c8b994ba6bb148d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaf45ced7f02c67bbab88e6bd46d5f92_JaffaCakes118.exe
Size

393KB
MD5

aaf45ced7f02c67bbab88e6bd46d5f92
SHA1

04228038f66a44d678409e21cc9c39789f6b4745
SHA256

0f1f188799ba937a8ae609e42325845d5fe23c0905f42d466c8b994ba6bb148d
SHA512

5d937eda0596f1c36376235cce727be54e577e69ec5dedf9414c6afaacb25913a20dbbaca30e507bd2d6f6e2218ae185769b1e8ec6ccbd49cb95cfab3ee2ec16
SSDEEP

12288:pYzh/yF1tpKV+n4o6/yf81C1/FVKrm0IBVPk:pYEzKavfX0eRk

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	3196	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaf45ced7f02c67bbab88e6bd46d5f92_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aaf45ced7f02c67bbab88e6bd46d5f92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aaf45ced7f02c67bbab88e6bd46d5f92_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 372
  2⤵
  - Program crash
  PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3196 -ip 3196
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...