dd0b90c97f8d1e80300246c5e35586e1cd54193b9d5702e00a3d2bcdb2738c08

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_626bb8d20eadf1e57950a1c4604f0a60.exe
Size

131KB
MD5

626bb8d20eadf1e57950a1c4604f0a60
SHA1

897b23f27197b8add504d1f9bb0d25886d6c4340
SHA256

dd0b90c97f8d1e80300246c5e35586e1cd54193b9d5702e00a3d2bcdb2738c08
SHA512

963a1d2f99dc641005576f28a7db4ecfbdc4d57379b0f97ff872d35e6f4031bef7b443ca904e73436ecb9178245c100dff052bb126fdd9b103231374c779ee36
SSDEEP

3072:/7CYnYdQwGDC0xTGNvi1/Ob368PsyWWB1/h:jCYnYdQwGho612z6FWB

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	4588	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_626bb8d20eadf1e57950a1c4604f0a60.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_626bb8d20eadf1e57950a1c4604f0a60.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_626bb8d20eadf1e57950a1c4604f0a60.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 464
  2⤵
  - Program crash
  PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4588 -ip 4588
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads