fd502d0736cdccad4831041af0e4505de9fccbb8237891d46f5d2cab4a28d165

Analysis

max time kernel
118s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2025 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_620fa39dd1bc64c352756d6e84e021b7.exe
Size

234KB
MD5

620fa39dd1bc64c352756d6e84e021b7
SHA1

27a2999bdb005ac8fb1d789ed2d63d92be7e87e5
SHA256

fd502d0736cdccad4831041af0e4505de9fccbb8237891d46f5d2cab4a28d165
SHA512

e91d4161de005bd38e8c4ccaa9c717906871dd481725648d9c8151c1a34e10ccc1be511866f965fd250fdda025d50d1f6824c1c20b78a628d60ac55c1d93a03e
SSDEEP

6144:ETLz/0qc5fTHBSHjqKvXU/pFpXbjBh04PEkpfK9h900f+s:E3r0qMTAtXUh/BKSD4v

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4628	1324	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_620fa39dd1bc64c352756d6e84e021b7.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_620fa39dd1bc64c352756d6e84e021b7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_620fa39dd1bc64c352756d6e84e021b7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 332
  2⤵
  - Program crash
  PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1324 -ip 1324
1⤵
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads