dd28a1a4260ecac7a54245e4d3a386132841494d13a24632b8e232dd48c9ad7f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2025, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_0610f9d02c70a5b5782808ff81bbb65b.exe
Size 41KB
Sample250121-vd18dstlas
SHA256 dd28a1a4260ecac7a54245e4d3a386132841494d13a24632b8e232dd48c9ad7f
MD5 0610f9d02c70a5b5782808ff81bbb65b
SHA1 e9b429fae5a7a03ac7a1cad715da8f05d747ed3b
SHA512 33c2f0f8805493a5336b0a898214580673e8484350d0753eab82612b816ee50bd3277957fb78624279a8dfebe61b9ac78f86ec9e62bcaf0b1e85fa7a2ffce887
SSDEEP 768:APeB4rSuOeho7BRqIaeCeyweluPAoB5h27/zEy/pvw:/vuOeh845eBeIP7B5i7EW4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4348	1944	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0610f9d02c70a5b5782808ff81bbb65b.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0610f9d02c70a5b5782808ff81bbb65b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0610f9d02c70a5b5782808ff81bbb65b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 488
  2⤵
  - Program crash
  PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1944 -ip 1944
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-0-0x0000000013140000-0x0000000013179000-memory.dmp

Download

memory/1944-1-0x0000000013140000-0x0000000013179000-memory.dmp