435a41f07b890f0ae06cc76da81b11a9bc651298d52ddbccd4f30387b67c3e79

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5e94a32264c96e8d25125dc474f1660_JaffaCakes118.exe
Size

235KB
MD5

f5e94a32264c96e8d25125dc474f1660
SHA1

5e45b6b2b303e0ac39b6d511e12157309d4c5d67
SHA256

435a41f07b890f0ae06cc76da81b11a9bc651298d52ddbccd4f30387b67c3e79
SHA512

6f52a688609bd171f3c05117a33a9a3e66e8feedf6379fc7958eba7a1187316c069160ed24ace1510cae529f163a0cb53d65cc0ae70c110be5b3885f08d5e64b
SSDEEP

6144:Ik0yeobA+U7ReAT0hxonJMabFR45PrvxIKpGPnbBa9:ooEjReAT0hxonJMaJ2vxInY9

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3656	1252	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5e94a32264c96e8d25125dc474f1660_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5e94a32264c96e8d25125dc474f1660_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5e94a32264c96e8d25125dc474f1660_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 224
  2⤵
  - Program crash
  PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1252 -ip 1252
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads