a431a86d4a07b08bd0293ae1b940c15a07274949e96d965edbd28740b15725fb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_384842c81c633f527c4a86b4c2ece9fa.exe
Size

97KB
MD5

384842c81c633f527c4a86b4c2ece9fa
SHA1

e71b0b6e5db55fb97b27dfb90d14651a222618a1
SHA256

a431a86d4a07b08bd0293ae1b940c15a07274949e96d965edbd28740b15725fb
SHA512

105277ee245d8b0c5ca08f6582b9ee3648ab58adce22feed1900e655fa77326b9d0cf5c7ad58e9bad79db0c45538155ce5550e03be09c986e6d7f4b96c94a3a2
SSDEEP

1536:0z5TPtasdfRdwI2tFmqx9t8Io+6f8/jgOGBfJEKrnenYeOyaLcgkRVW7yhK4tJFz:mKsByoqx9tvo7OfjmneYyKcgk7DFtN

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	4644	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_384842c81c633f527c4a86b4c2ece9fa.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_384842c81c633f527c4a86b4c2ece9fa.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_384842c81c633f527c4a86b4c2ece9fa.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 248
  2⤵
  - Program crash
  PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4644 -ip 4644
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...