a66f96b9d5d54443101edac80b7d49db6f4ad755cf21bd1521a5aa76e5245cc1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
Size

190KB
MD5

098490ce23ae57ebdecaa3ff542602a6
SHA1

de3e9ca821fca772fdef03cebcc8130a84a8a48d
SHA256

a66f96b9d5d54443101edac80b7d49db6f4ad755cf21bd1521a5aa76e5245cc1
SHA512

d450517f313a2771a966c808990a8d6633b86c34de1261ddfc78841c2920e583ce81c073ccbb309afe70127d7e4aae67f679e9af661f8aae22f1d2d314bb4654
SSDEEP

3072:FvvCIrf5ZOoxFWvVtgOEzhMCxjCoKbHkD5YvbCMxQpJ8EvHGUyp3YvL8hoceInXC:9CRQFJPx+oCvmKQNHvwZhocj+h3

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1540	2524	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_098490ce23ae57ebdecaa3ff542602a6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 292
  2⤵
  - Program crash
  PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads