756f503b3c8d30d4ea951f00119a708a856b1bd88fa4c1b036563e7894b7c09e

Analysis

max time kernel
134s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbe4a8537ba250c27b6b6a74fee0b2bb_JaffaCakes118.exe
Size

297KB
MD5

bbe4a8537ba250c27b6b6a74fee0b2bb
SHA1

a36779f623174277c86e20200719ece16b6f25a2
SHA256

756f503b3c8d30d4ea951f00119a708a856b1bd88fa4c1b036563e7894b7c09e
SHA512

0762ea53a2f92cd5421f35a2c82a5325da1dc1025a45e9c7a04ec89b1b083860782c4feed942d3e7697de30ed33ae6b2eb0580ad9a28b5775e70ba4d4107eae2
SSDEEP

6144:2wporPkmzR4NyisnKbN6N3j1i1VZ428ygSNVmxxxxxxxxxxx:BpovuNyi86N6EVZ4Zypyxxxxxxxxxxx

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3112	5072	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbe4a8537ba250c27b6b6a74fee0b2bb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bbe4a8537ba250c27b6b6a74fee0b2bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bbe4a8537ba250c27b6b6a74fee0b2bb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 608
  2⤵
  - Program crash
  PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5072 -ip 5072
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads