5aeced5a36b377c8e9c34cc2c16e3434f785390809c5416afa66b1f07733f36a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa0343ceede9c4d58f1d8ea374ec9572_JaffaCakes118.exe
Size

164KB
MD5

fa0343ceede9c4d58f1d8ea374ec9572
SHA1

2c69c8ad2d47e0867ed3402715f20a46ef8fc5be
SHA256

5aeced5a36b377c8e9c34cc2c16e3434f785390809c5416afa66b1f07733f36a
SHA512

a0534014cfd8c19517b4207414168f7cab287a9c16139fece3ba56d8485a96a7593935d799ccc0eef1de1d7aabac41ea2527bf76545ef7625b192776cc5d7270
SSDEEP

3072:s3+/zzdsyC7jA9vGMg1Obuqd6XZafyrlA24HObYy2YxQJ6EJEXBr:RdN4c9v8kn6pa65Ad4cYxlIE

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
432	3168	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa0343ceede9c4d58f1d8ea374ec9572_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fa0343ceede9c4d58f1d8ea374ec9572_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa0343ceede9c4d58f1d8ea374ec9572_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 484
  2⤵
  - Program crash
  PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3168 -ip 3168
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...