dc6b89e3c1aac0d7a98fd9f491cdc55b9b6fa3f6f2c87dc2b6aa9dee3492d1ff

Analysis

max time kernel
91s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a951e4623832dcda43b065b23c44a99e_JaffaCakes118.exe
Size

159KB
MD5

a951e4623832dcda43b065b23c44a99e
SHA1

3f89d10bdea27e2aa976a69a0e684fccdc299ed3
SHA256

dc6b89e3c1aac0d7a98fd9f491cdc55b9b6fa3f6f2c87dc2b6aa9dee3492d1ff
SHA512

6bdab399822af399ae5e4dc3f5e628913bf4d2c39ceebd43ff6757ef98133fa1d94ad1c282185e9a511d6d9b7ce497e27b2846ef1e939d0a1bf6f41ce4b07780
SSDEEP

1536:YKPEo7vWuZtAV9PJE4h+lrkFtEd1NdhB3f0LWc9/7NIO2sYcAOz02UqejgOn6+:Yho7v5YV9XekHc9mx9zNIO2sYSdUfX6+

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1092	5072	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a951e4623832dcda43b065b23c44a99e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a951e4623832dcda43b065b23c44a99e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a951e4623832dcda43b065b23c44a99e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 280
  2⤵
  - Program crash
  PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5072 -ip 5072
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads