4edebdad5db6686b6d2310bac908929c40bb126f0d67bc6251207c397b23e0c7

Analysis

max time kernel
142s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438fee4986d75c2fb9a1f9239010f8ca_JaffaCakes118.exe
Size

698KB
MD5

438fee4986d75c2fb9a1f9239010f8ca
SHA1

c29e54756f10517557349c0bdb573d7847e00429
SHA256

4edebdad5db6686b6d2310bac908929c40bb126f0d67bc6251207c397b23e0c7
SHA512

ea6fd27158a95f167074548200aef75cb0089c47ac9a21a074374bd082f3d44ae4e21baa490cb1869351010b8e11f7815f44c7d4bd89b26e8296aa4dd55d8598
SSDEEP

12288:pQyHYh6UeeLrQp0/XoU8bTRsdi9JSZPLGhX9H1QO7l4n2A1muOhsXL:pQ6UeeLkMB8bTRskSjeXh+Ok7OhY

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3660	3120	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	438fee4986d75c2fb9a1f9239010f8ca_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\438fee4986d75c2fb9a1f9239010f8ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\438fee4986d75c2fb9a1f9239010f8ca_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 224
  2⤵
  - Program crash
  PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3120 -ip 3120
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...