118a5e065609e7ab81803b48a2f0da65d16b80234db23f40199d001cf078c0ee

Analysis

max time kernel
96s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe
Size

172KB
MD5

44fbd9d7c8912ad50f2eabc715efb000
SHA1

fec8dfacc5054e63c3c65d1c69cc0f3923164efc
SHA256

118a5e065609e7ab81803b48a2f0da65d16b80234db23f40199d001cf078c0ee
SHA512

3f6e1783e3b40fcbcd6ad586b323c549aa562622fbbe449d1643f3959e19ae2aaf350620ea760a3b1d00a9a2ac19343c594ed778a9fe02c0d3cf40759c641ffb
SSDEEP

3072:oV16GDa89pb2d3xZnDhCz0kcUnjtJcNT9M8zeEQ8v6e3DMz4ZQOL2xwGjhP2zH:EQGMdhVDhCzCQBJmFeE5BXZJIhPA

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	372	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44fbd9d7c8912ad50f2eabc715efb000.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 376
  2⤵
  - Program crash
  PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 372 -ip 372
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads