d8c09e328bee42dac7172225f165e008f21888304ad4e8be7900b8f205be3e77

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbd5d0aeb5c99d627b5fd234a3c1bb6a_JaffaCakes118.exe
Size

356KB
MD5

fbd5d0aeb5c99d627b5fd234a3c1bb6a
SHA1

931e0a22dea700ab2ebfd22cd5386ccb047d5f24
SHA256

d8c09e328bee42dac7172225f165e008f21888304ad4e8be7900b8f205be3e77
SHA512

7288d674151095a18f2033024266c6a698f9d8bcc08c30605ef52413e2e48df0af7e995e636b944d34842b68ee89e65163acd1c35a2426ac927e86986739120e
SSDEEP

6144:dGPy6MqYL2w664ADU+9PTLG/nLmEFLpexQyKrvQbBXHf4DSnuoTTRaz:Ia6M9L2w6ODUCPTa/nLT/oKrvWXHfVk

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4184	1296	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbd5d0aeb5c99d627b5fd234a3c1bb6a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fbd5d0aeb5c99d627b5fd234a3c1bb6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbd5d0aeb5c99d627b5fd234a3c1bb6a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 232
  2⤵
  - Program crash
  PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1296 -ip 1296
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads