ac633cf69e5a25843ff0584748f3351df6098afe830bd7b860007727dc9f029a

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe
Size

297KB
MD5

eacf0d808b2b71ca047ae17ea4061847
SHA1

dda3276a57f457816eb3d2215d6d3bff8dd23dc7
SHA256

ac633cf69e5a25843ff0584748f3351df6098afe830bd7b860007727dc9f029a
SHA512

f285388ea526c7b06a86ecc6c7f77f3abc23aac69d0e9bb7bd6c3deb85d51f9003b126e131bc0f1eb0cb96b35e1cd55b36f4d2c258e5026c5042ed960c4c53d1
SSDEEP

3072:qpe7LPXFomWqLEnCYvcvIXRTy1hmUI0xlOcwJIvS3oGcFuG9hFoHk148GzMwfp3z:keXmvDx8hzNxl8JIvSiFxTO8GzM8

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
684	2568	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eacf0d808b2b71ca047ae17ea4061847_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 248
  2⤵
  - Program crash
  PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2568 -ip 2568
1⤵
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2820,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...