b4fb5c986106797629e3820ec740e5e8e8583429de0a045f8c7f999dfbf4d6c6

Analysis

max time kernel
134s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c868790860bac170e9e0a506f9f023eb_JaffaCakes118.exe
Size

16KB
MD5

c868790860bac170e9e0a506f9f023eb
SHA1

41330e422479c0910a067925b9580829b73c6d36
SHA256

b4fb5c986106797629e3820ec740e5e8e8583429de0a045f8c7f999dfbf4d6c6
SHA512

c4008fda6475b299c24ef1cc8c091fda82581bedd075c4d5c6e2fd41cc5259aa65b7b103e43f9e1ab10e5f2799a9b317484e90e5facb20103399803db0f137f0
SSDEEP

192:t1Xv6EZBMUuhj+3jsgyG+NcUewiyxTpJm9s:rtMi3wgytewiy89s

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4324	2784	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c868790860bac170e9e0a506f9f023eb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c868790860bac170e9e0a506f9f023eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c868790860bac170e9e0a506f9f023eb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 228
  2⤵
  - Program crash
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2784 -ip 2784
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads