022120942462cebfeb3592a5c912284f6617254797ac4c58924b25997e8252a4

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88c474fd13313fbd09a35b5a2980c64c_JaffaCakes118.exe
Size

336KB
MD5

88c474fd13313fbd09a35b5a2980c64c
SHA1

9e10aeb07ef95b7b1a374197fccc5deddc75715f
SHA256

022120942462cebfeb3592a5c912284f6617254797ac4c58924b25997e8252a4
SHA512

b5fe148d64fbc0eefec598c8a431c041242dd67debb1a31fcf9f68f7ada43f4c274ba72aefa7306a5eb37e6710719ff7807ed661deb3674740668b961b88554a
SSDEEP

6144:ktGRko0GIldIOwE/TrQdJQV021fmz3KMQ1W3jo/dgGfLFS:kckbGA2v2WQF+zO1+cU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	324	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88c474fd13313fbd09a35b5a2980c64c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\88c474fd13313fbd09a35b5a2980c64c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\88c474fd13313fbd09a35b5a2980c64c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 508
  2⤵
  - Program crash
  PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 324 -ip 324
1⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3996,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:8
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/324-0-0x00000000006C0000-0x00000000006C3000-memory.dmp

Filesize
12KB

Download
memory/324-1-0x0000000001000000-0x00000000010A9000-memory.dmp

Filesize
676KB

Download