7bf404217ca864ab3dacc2b17a3dda23c65a580a062fa3a6c13b6a6f03aecccc

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d11768a81df9ea9fa968e8ac470a9096_JaffaCakes118.exe
Size

437KB
MD5

d11768a81df9ea9fa968e8ac470a9096
SHA1

e0712106a4c4d7beb65d3dd6a5b9294a42926235
SHA256

7bf404217ca864ab3dacc2b17a3dda23c65a580a062fa3a6c13b6a6f03aecccc
SHA512

32d65265be8dc4f346c744c7c1807d6ddec120be76f7762c8122cc1440d1ed24ec42c459e7f25450986081ac7f611ea3fdb759f93fd0c45a0789fce3fc8b0541
SSDEEP

12288:I8KncQlqxW7MvP4mQTnjRadi4nTctTMaWOUFPYOC:Izceqk+QVnjREfnTc5MR9YO

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3500	2208	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d11768a81df9ea9fa968e8ac470a9096_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d11768a81df9ea9fa968e8ac470a9096_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d11768a81df9ea9fa968e8ac470a9096_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 336
  2⤵
  - Program crash
  PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2208 -ip 2208
1⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4464,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads