9c6f9ec885396ea45f06b2e426e7d5b2b942d60a1ab868a84275987c09984a05

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1557fa7019d5d281a1b8c878bcf817bb.exe
Size

201KB
MD5

1557fa7019d5d281a1b8c878bcf817bb
SHA1

fee022f9e73695c68965db8a1ae86350b56db7c7
SHA256

9c6f9ec885396ea45f06b2e426e7d5b2b942d60a1ab868a84275987c09984a05
SHA512

ff25e02906a717eea3107846b08d4ed72f1e86f6f16eefe79c83a1b68e2e7bdda9e2ceb6a90bb848edf0c10f652211a0854db5c31eaa0930b364e9e54222386a
SSDEEP

6144:VwGPqheAAyL8sg/z941Pv3KFsrhWF99+bksg+:VwGay4Pg/yR/Hte94osd

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	3276	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1557fa7019d5d281a1b8c878bcf817bb.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1557fa7019d5d281a1b8c878bcf817bb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1557fa7019d5d281a1b8c878bcf817bb.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 464
  2⤵
  - Program crash
  PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3276 -ip 3276
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads