4e644b128a71282f5b8fb048f76bad571129bc8001a38ac5aafab1043fd69e3d

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6b0b3dd56fab03cde50f1e5f0ef83a8a.exe
Size

188KB
MD5

6b0b3dd56fab03cde50f1e5f0ef83a8a
SHA1

cf621596ee2595ae6ad39cb630462e50d08716f1
SHA256

4e644b128a71282f5b8fb048f76bad571129bc8001a38ac5aafab1043fd69e3d
SHA512

b6115da8239eadd71ffa68cbaf90104521a0a95ceeeb67ccdd77cb831de8b42457f67488508ff51615b345574032cac4e021c919b8360d04af0522db71252662
SSDEEP

3072:VOYG9vqBBZM3F7zFetXw6ttCPFs7toHBK7g7v6On6:VOYoaBZERUgktCK54GgW

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1128	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6b0b3dd56fab03cde50f1e5f0ef83a8a.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b0b3dd56fab03cde50f1e5f0ef83a8a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b0b3dd56fab03cde50f1e5f0ef83a8a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 368
  2⤵
  - Program crash
  PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1128 -ip 1128
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads