1ab8f3a1a6c45bd71971830695341ca555f8ccfad53277ffdefa9154594f4c7d

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f91bf6abc3e3c1f1d7ccb851c04d3963_JaffaCakes118.exe
Size

188KB
MD5

f91bf6abc3e3c1f1d7ccb851c04d3963
SHA1

a7f79dc8ec8f42b55fbb04984b5448947eebfde3
SHA256

1ab8f3a1a6c45bd71971830695341ca555f8ccfad53277ffdefa9154594f4c7d
SHA512

a7fa23caaa61817c8210db470cb34e5ba9e60c3e6a3ac58786f2b48d619d0c618d90349631280490602d684aa1b7130dde4834a3399c650b1da4d2ca91670770
SSDEEP

3072:4StQnGrRnDWYwA0bUumDZz+Guu4pHigKCu+j34F2bsri56FJCJ85xYlz:4StQGtDN0bMDZz+pu8bjoF4UCJ8X6

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	4692	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f91bf6abc3e3c1f1d7ccb851c04d3963_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f91bf6abc3e3c1f1d7ccb851c04d3963_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f91bf6abc3e3c1f1d7ccb851c04d3963_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 328
  2⤵
  - Program crash
  PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4692 -ip 4692
1⤵
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads