bdf77469f61ee2c6f5901cecb0890083621b12a914b2638e9de2222d32bdf32c

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df8361b0ac6c8f01dfd7f88504a0b877_JaffaCakes118.exe
Size

204KB
MD5

df8361b0ac6c8f01dfd7f88504a0b877
SHA1

5c6f27553b0effd993cb98a22f308b946e7cf67d
SHA256

bdf77469f61ee2c6f5901cecb0890083621b12a914b2638e9de2222d32bdf32c
SHA512

a9927cd2dc837223907f12253f54c533b01dbf07485f49e3858f55d64e5074033682e1a13495c038239c807367e790b8d44e5d674cb202238c669bc77ef1ff4d
SSDEEP

3072:IKqYNVsbEv2JRKoPQ66HOczGVyQyDZ1xfAgL09MggICk7YzClS2:cbbEgVPQ6SOcqyQy919ho9MG5Wyh

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	3464	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df8361b0ac6c8f01dfd7f88504a0b877_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\df8361b0ac6c8f01dfd7f88504a0b877_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df8361b0ac6c8f01dfd7f88504a0b877_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 540
  2⤵
  - Program crash
  PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3464 -ip 3464
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...