912467c608fcd6d7faff974506ba2c9aa297608b0cb5e81af7aec874249dc759

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_912467c608fcd6d7faff974506ba2c9aa297608b0cb5e81af7aec874249dc759.exe
Size

80KB
MD5

656f530c5858d2bf7c51a6964640de81
SHA1

3c67086f1565d6400692c06af0c1b3bff2d46eb0
SHA256

912467c608fcd6d7faff974506ba2c9aa297608b0cb5e81af7aec874249dc759
SHA512

04165be56387e2c687e1a7e2db7d681ca78ace75c3c447ccd3eeeeca28bab1e285d94f2e156ec2643655fe3f626a59d91897c17c6fa9d5f4450bb2962437be30
SSDEEP

768:GBYUq/Ae2QCC6AAAU8xyE26ZdOaHiNSnTTpvxTqE5ZvEzRWZeS6RTUhS:kYX/Xp9wxKdIaNnT1vxTfCCQRQ

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3136	4796	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_912467c608fcd6d7faff974506ba2c9aa297608b0cb5e81af7aec874249dc759.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_912467c608fcd6d7faff974506ba2c9aa297608b0cb5e81af7aec874249dc759.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_912467c608fcd6d7faff974506ba2c9aa297608b0cb5e81af7aec874249dc759.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 216
  2⤵
  - Program crash
  PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4796 -ip 4796
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads