6f6445a629c8fff724d2a1ad61a5487011308f2b3a72236072d45026f34bcc09

Analysis

max time kernel
95s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
Size

220KB
MD5

ba1947b8d4ec4a6cb8374931160827da
SHA1

dd1f286416aa3896d6318f5048147cb8cfe73dda
SHA256

6f6445a629c8fff724d2a1ad61a5487011308f2b3a72236072d45026f34bcc09
SHA512

8dd2badfe8e3dea12f15b9e2d8278c4227ff2a4be028e8cf6e141e602205ae014b5709fc14a2a03808396df263899f6a144815fa277bc7df5f646a45f5fa0702
SSDEEP

6144:lwkwJej1coHvEf1e2a16Po3u0q3dM5KxSW3Y:Fke5coHYQ2k6fX

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 4156 set thread context of 0	4156	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	4156	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ba1947b8d4ec4a6cb8374931160827da.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 368
  2⤵
  - Program crash
  PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4156 -ip 4156
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...