1a1aca35c0e6b3cff48679122c8ea01995e3ddd635e00064944793711425a197

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc0808360f0f814318e1e18e5a790a32_JaffaCakes118.exe
Size

196KB
MD5

fc0808360f0f814318e1e18e5a790a32
SHA1

2699353aefa84d8c2b4c156fa8ef042046eb0fe1
SHA256

1a1aca35c0e6b3cff48679122c8ea01995e3ddd635e00064944793711425a197
SHA512

2cf8015432f828912e1789f9d8eb62173a3877fa016099a64c6bc8f495038dc87411b29b2ae83bd0a8b0551a89cf1f12a69f5e0a9b6edaaefcd1924aaa36e944
SSDEEP

3072:bT3v+91vdwBEEPxflP3likUawbJuTMndBKv:Xo11w/fl9iThnU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3884	3828	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc0808360f0f814318e1e18e5a790a32_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc0808360f0f814318e1e18e5a790a32_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc0808360f0f814318e1e18e5a790a32_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 280
  2⤵
  - Program crash
  PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3828 -ip 3828
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...