bb25f6ce5c7828ed3bb66f609d4e537d5ec76464029251c66f759a54adf8aa81

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c23fbdfa2952c288583e772521aa2a59_JaffaCakes118.exe
Size

382KB
MD5

c23fbdfa2952c288583e772521aa2a59
SHA1

c487b9d236465f8966d17d937d03707a9615b2df
SHA256

bb25f6ce5c7828ed3bb66f609d4e537d5ec76464029251c66f759a54adf8aa81
SHA512

c050b0ccc98e72db27214eecb188d241fc7fb5beec35f77ac699976a94f09aa5dc8ca7006cc7b6e8d58590924080c6ce5c1c1d560ed82d3c7bda4aea0d140c3b
SSDEEP

6144:EPjSqtz0UmP5vISF/MKXugAW4/QK8+d5lsU/7UPmhpo/scS0V0m7QBmOA/TS55NW:ySqRUtISF/MKXN4ofy7UdEeH7uKWz/Ew

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
380	852	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c23fbdfa2952c288583e772521aa2a59_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c23fbdfa2952c288583e772521aa2a59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c23fbdfa2952c288583e772521aa2a59_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 452
  2⤵
  - Program crash
  PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 852 -ip 852
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1036,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...