1fa001abcfaca3c32c016bb183dddc3d26a6f344aa452986d540ea4d199101df

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2025, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
Size

171KB
MD5

429913e1cb8b1ead462b24d06d4f2456
SHA1

03b99b0338ba69014a6ec6c2fb48fd9ec5140a4b
SHA256

1fa001abcfaca3c32c016bb183dddc3d26a6f344aa452986d540ea4d199101df
SHA512

568b16e9fb8aba967cd0b74180b15b0cef9cf212d0afc03cd8e8f5d11b4460a5b181647e33bd5d576d337fbdd8034925539b4987fce8db5b14a0be1da4b128ee
SSDEEP

3072:pgRhPXq8b/aW2S7AxN9jt2qidhoFgug7S57a5XeOl8Zjx6lyf1chWj23U:pf8b/aFS7e9jtydhoFgug755XFuZV6ll

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	3064	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_429913e1cb8b1ead462b24d06d4f2456.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 264
  2⤵
  - Program crash
  PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3064 -ip 3064
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...