e6fe59b6a7ad957d5b8a67ae641a0008a6764c486f414a07860f738afb014f3d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2ca6453a391b7d8eb00d63e274ea843_JaffaCakes118.exe
Size

172KB
MD5

d2ca6453a391b7d8eb00d63e274ea843
SHA1

14e107604480aeca6d669304cd08b65424a7247a
SHA256

e6fe59b6a7ad957d5b8a67ae641a0008a6764c486f414a07860f738afb014f3d
SHA512

c7908d6e481ddda83074fd391baf3f721fb3e3db75f7b6fcb2c49c592d749d7f9e5e7d018f6684957ab5d6e398716d16170059d0eebf70708de5ad3bb6846c55
SSDEEP

3072:jq2M5+r3HZODwPm33bKAi5z5U8BRyCkfMTJAVw3zNB1/F3e/K0ih34:+2M5sOSu2JKCyW1/FeS0ihI

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4420	3132	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2ca6453a391b7d8eb00d63e274ea843_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d2ca6453a391b7d8eb00d63e274ea843_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2ca6453a391b7d8eb00d63e274ea843_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 476
  2⤵
  - Program crash
  PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3132 -ip 3132
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...