a049ef15af81082d52427d53bfaf45cdad2959833954b06c437fdc2f3545f3c0

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbd6db946429019d7020557a9e0061a7_JaffaCakes118.exe
Size

185KB
MD5

fbd6db946429019d7020557a9e0061a7
SHA1

c6b586d299c139fe1e8ae58bb4167aef79c72d2b
SHA256

a049ef15af81082d52427d53bfaf45cdad2959833954b06c437fdc2f3545f3c0
SHA512

0035327a7736bf703098f3cfe8e6d7194f5d47464ba43aa9a6551a65c58c5fbdd3a43ad91ec38f5247d1eb8bf80fcb837ddf02e0462519b1620da4b9ff897025
SSDEEP

3072:Xgbr6MsRktSjArkKoBrGLBMIjjKVBRV1FgxK8f1IpkMKy82/92V7B9KhLXQ7EgeO:Ax3ScjuGeIjjQRVToK8f1Ipk3y82/U7W

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
208	3032	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbd6db946429019d7020557a9e0061a7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fbd6db946429019d7020557a9e0061a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbd6db946429019d7020557a9e0061a7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 328
  2⤵
  - Program crash
  PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3032 -ip 3032
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...