92a1e845f8ec577e3339bc77dad87d36ce06f9e9e8acee70e70e769d56c8b45e

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_219b9f8935bbd6a99b64b80680bc21d5.exe
Size

257KB
MD5

219b9f8935bbd6a99b64b80680bc21d5
SHA1

c4b9ad179172a73aaf40df9c177f2b9a47c28bec
SHA256

92a1e845f8ec577e3339bc77dad87d36ce06f9e9e8acee70e70e769d56c8b45e
SHA512

aacab17f362f1616594d5d95db4db4d201130dd55bcb8e4f8b13fafd37eb58f006852ea209790960b4b1f37c9e176f81ed2dc89e46f0f02b696f3c5712815285
SSDEEP

6144:1+g/UuZuwAjDwzzCAoyzOC6IvDePVf6MCRON/7:1CRDqCXyqief68N/7

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5004	4456	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_219b9f8935bbd6a99b64b80680bc21d5.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_219b9f8935bbd6a99b64b80680bc21d5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_219b9f8935bbd6a99b64b80680bc21d5.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 280
  2⤵
  - Program crash
  PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4456 -ip 4456
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads