a6d1b4286d4352df6c2db5fa8d753ae5d580fd7d17f661c2c0892e55b6afcc41

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_437cae40bcb6fe3df24c7ad1e2ebcb43.exe
Size 10KB
Sample250127-ze5dnavpgl
SHA256 a6d1b4286d4352df6c2db5fa8d753ae5d580fd7d17f661c2c0892e55b6afcc41
MD5 437cae40bcb6fe3df24c7ad1e2ebcb43
SHA1 7c91b1d411d492e6bdadd1912a021dcf1db6b924
SHA512 1aa238afc49e9f2f5fe081dbdcf97ad83b8bcd31a3c76440d0a72a71c698d069344dd31de053e8a4461ac4ee42e32a5961982ef8889778a067b0ec79994c940e
SSDEEP 192:q1yeRj1X/M3a7Hi/GjF/u8vca2EKFelle7c1hOvVgpti:Yyellh7oK/vcagF4YcLO2q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4204	1624	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_437cae40bcb6fe3df24c7ad1e2ebcb43.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437cae40bcb6fe3df24c7ad1e2ebcb43.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_437cae40bcb6fe3df24c7ad1e2ebcb43.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 252
  2⤵
  - Program crash
  PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 1624
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-0-0x0000000009100000-0x000000000910D000-memory.dmp

Download

memory/1624-1-0x0000000009100000-0x000000000910D000-memory.dmp