838223b38a310da87eb5c5601e9f2c2ce5ccea4f31e52ad724368730ef9c89eb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_632d8fb50160d2baf2b9d3bfb7051853.exe
Size

283KB
MD5

632d8fb50160d2baf2b9d3bfb7051853
SHA1

9761d966c931867235457440b2c587c2a371c096
SHA256

838223b38a310da87eb5c5601e9f2c2ce5ccea4f31e52ad724368730ef9c89eb
SHA512

9bfbc6e122afddcc67180bed05fe3f8e85dc60caffe15835a7a3ee16544347b7292f0fe940da5e8c3bdc42f80082fc0cd0abbd89d4aa6f4f51b794f56456ddc4
SSDEEP

6144:jmcD66uTjt5JGmrpQsK3RD2u270jupCJsCxCM:acD66U4Z2zkPaCxD

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
216	1188	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_632d8fb50160d2baf2b9d3bfb7051853.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_632d8fb50160d2baf2b9d3bfb7051853.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_632d8fb50160d2baf2b9d3bfb7051853.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 224
  2⤵
  - Program crash
  PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 1188
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...