b27f96bdb9ec570344f9138b463d5d4c4d349aa38cafb5a7c681b549b167ae64

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

870e2d4a129f1dce9327eb9053d3791d_JaffaCakes118.exe
Size

279KB
MD5

870e2d4a129f1dce9327eb9053d3791d
SHA1

8f5e12ecc481cfe3938f69504d325e43e9af3c26
SHA256

b27f96bdb9ec570344f9138b463d5d4c4d349aa38cafb5a7c681b549b167ae64
SHA512

125873a364490d3fed44f24f91ef033e6ca9654742cd58b24a0d4ca88dec5976c0979c10ecb799998351fb58166b01865a764ae42a90f1cea5b1de57a4e37276
SSDEEP

6144:tEYZeuUvp1azt1vGgXB0Snyr51aBpBX20Yexsj6lBK55RIDMxcVJ0:feuUhUzt1vGgXB0Myl1ajZYbj6lBuvIm

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3572	4636	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	870e2d4a129f1dce9327eb9053d3791d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4636	870e2d4a129f1dce9327eb9053d3791d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\870e2d4a129f1dce9327eb9053d3791d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\870e2d4a129f1dce9327eb9053d3791d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 496
  2⤵
  - Program crash
  PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4636 -ip 4636
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-0-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/4636-1-0x00000000021E0000-0x000000000222E000-memory.dmp

Filesize
312KB

Download
memory/4636-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4636-8-0x0000000077600000-0x0000000077601000-memory.dmp

Filesize
4KB

Download
memory/4636-7-0x00000000023C0000-0x00000000023D0000-memory.dmp

Filesize
64KB

Download
memory/4636-6-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4636-5-0x0000000077C12000-0x0000000077C13000-memory.dmp

Filesize
4KB

Download
memory/4636-4-0x0000000002330000-0x0000000002340000-memory.dmp

Filesize
64KB

Download
memory/4636-3-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4636-9-0x00000000775E0000-0x00000000776D0000-memory.dmp

Filesize
960KB

Download
memory/4636-12-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4636-13-0x00000000021E0000-0x000000000222E000-memory.dmp

Filesize
312KB

Download
memory/4636-14-0x00000000775E0000-0x00000000776D0000-memory.dmp

Filesize
960KB

Download