722a0037f4544ddab2b212533cbe71e5c78f7e5005a8b41a7631fae1e3e85f47

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb9826bd168eeb4c00d39fd49b993a64_JaffaCakes118.exe
Size

68KB
MD5

fb9826bd168eeb4c00d39fd49b993a64
SHA1

4d9594e44a63df1f1206972b69544e32cde43e3a
SHA256

722a0037f4544ddab2b212533cbe71e5c78f7e5005a8b41a7631fae1e3e85f47
SHA512

4ac069f35039005e92c7ec3dde21bbc42d43c070008664272ba0497b6c42b6f78c4919914d37a18c032e17f41e709715184c5701135e2caeb9cc25be692aee94
SSDEEP

1536:ZzZWBsk285tPQKaDEtzvYKNmBs93dtx9d6jOwpxA9JClP4xzZ+t1SIqC:gskp5tPQKaDiYKNm03d1d1wpxA9JClPc

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	1660	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb9826bd168eeb4c00d39fd49b993a64_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fb9826bd168eeb4c00d39fd49b993a64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb9826bd168eeb4c00d39fd49b993a64_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 224
  2⤵
  - Program crash
  PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1660 -ip 1660
1⤵
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads