e8d285520e2a3a6d04e73e5a4a63922b1084b9b05684518e3876c39cbfb3dfb7

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d348b9f1678e7f83917bdd9ec0169a20_JaffaCakes118.exe
Size

164KB
MD5

d348b9f1678e7f83917bdd9ec0169a20
SHA1

e4278f96944742fe9773f02f058c1e1c73272ed1
SHA256

e8d285520e2a3a6d04e73e5a4a63922b1084b9b05684518e3876c39cbfb3dfb7
SHA512

52fbee95ba7a823b4eacc80ca81f3eadb4dd9391bfee2c64dda1e19005943c33c1d078ecaaefc20387ec56485ce132c63bafe2971a1aab67a042330ec6870515
SSDEEP

3072:fE/D6PZF2Z1rumCw0HYAbeQBpkI2dfZEQAIpg3bPfFyB8I48iLMM:fSwPu5P0HYA1/kIMDa37tRAiLM

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	1096	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d348b9f1678e7f83917bdd9ec0169a20_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d348b9f1678e7f83917bdd9ec0169a20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d348b9f1678e7f83917bdd9ec0169a20_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 540
  2⤵
  - Program crash
  PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1096 -ip 1096
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads