1ba4cdf98fe8dfb296395d03ac1528f8b505799b25f025a21746574acf7af1ee

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2025, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_40be4a80bda341d45bdce52fd71f1016.exe
Size

276KB
MD5

40be4a80bda341d45bdce52fd71f1016
SHA1

1c1d22748408df3aecc294d82f54d4196fc20f07
SHA256

1ba4cdf98fe8dfb296395d03ac1528f8b505799b25f025a21746574acf7af1ee
SHA512

592902f6a410ce4e280b0102b0631f645bea67dca57991434b551c17b616e0be85fe6f8d70c18d38372afb180cb72b5d63fccb454b5816d8eaf0474778dffc06
SSDEEP

6144:gJx+g2CJuBZ4fdhpXhn6UHWTlX2twd49i6L5Sp8:L9ZCPBh6U2TlXd4Y6LEp

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	2792	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_40be4a80bda341d45bdce52fd71f1016.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40be4a80bda341d45bdce52fd71f1016.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40be4a80bda341d45bdce52fd71f1016.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 420
  2⤵
  - Program crash
  PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2792 -ip 2792
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download