eb1ab3410743f955d78e984fa926c1794ac235f5b852a1bb14b66a6a1ccebb69

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe
Size

191KB
MD5

9595f24627dc2b8d0e3305ebc60dd424
SHA1

efd13f451f2d7df8bc5f1eeef00b8f0c99f47c65
SHA256

eb1ab3410743f955d78e984fa926c1794ac235f5b852a1bb14b66a6a1ccebb69
SHA512

45f5da36c878365b6a623a275a5ed670ec4c46418b1aa75f32f2642dcdf759ef1f37340f5e57c76749383d3a4de0b11ba67adf90270ba399db583c09d1b86a92
SSDEEP

3072:hvxwXAFqJNvYU6Kx72vo3WiKlrud4Kli/acnC9yGerfUQ9c:4XA2JYU+vVhlr64Kw/PCIGerf

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2992 4120 WerFault.exe 9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe

pid	pid_target	process	target process
2992	4120	WerFault.exe	9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9595f24627dc2b8d0e3305ebc60dd424_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 288
  2⤵
  - Program crash
  PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4120 -ip 4120
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads