fd963b688b045b800b03d7b3150041a9efe1fd3475a2ea08774325b68df6fd67

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee8eca6b5859b7dca954ffb34ada6de_JaffaCakes118.exe
Size

393KB
MD5

eee8eca6b5859b7dca954ffb34ada6de
SHA1

cfeb901fb53abb1d0173b81713dcb9bcc3fbd432
SHA256

fd963b688b045b800b03d7b3150041a9efe1fd3475a2ea08774325b68df6fd67
SHA512

2ef826167bda65f60bc821f15f6a588e08d5a16c70b3c50cbec22638900d14f9d19ba544749dfdad6d97c3b49278362030a2bd0a321c8aadf7da115a970e137e
SSDEEP

12288:9W3KpJI6xj1dV9fJcEXW4OYIb5IiENCaGNPO:9WCb1dV9fJhXWGHNePO

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3416	2636	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eee8eca6b5859b7dca954ffb34ada6de_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eee8eca6b5859b7dca954ffb34ada6de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eee8eca6b5859b7dca954ffb34ada6de_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 268
  2⤵
  - Program crash
  PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2636 -ip 2636
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads