1195b6e737271930b417d14b43b0d48259ba52ec9337ac63ffaa21197d8efa51

Analysis

max time kernel
94s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_bb9694e4fdd7556909779f2aca72ed07.exe
Size

187KB
MD5

bb9694e4fdd7556909779f2aca72ed07
SHA1

e74fefd342e8bda5363c96f2fe0224c013e57957
SHA256

1195b6e737271930b417d14b43b0d48259ba52ec9337ac63ffaa21197d8efa51
SHA512

fe176e3171e0b42d63d5b6ff69eb2202d21fdbd2a159bd6d788892dedf15a730f8f49a981c4a3f781b2babfd1319f283c1574439618f22ee1632d12e2dbfcba3
SSDEEP

3072:SZ8AZL/T1YtPqk1Njc4e+jvMyiZ81i8qjmfgak05DoA38OiD+pUZgLe0JR8zc7H1:SZ8KT1Ytik1vTJiScAZk05DoAudgLeaP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2176	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bb9694e4fdd7556909779f2aca72ed07.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb9694e4fdd7556909779f2aca72ed07.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bb9694e4fdd7556909779f2aca72ed07.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 468
  2⤵
  - Program crash
  PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2176 -ip 2176
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...