3e92efb8de737220cbc5017a56eabd78612c33256fef1abe82b11b68e13e472a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b8b6f052ed5048f3c0c824f12f8c892_JaffaCakes118.exe
Size

492KB
MD5

8b8b6f052ed5048f3c0c824f12f8c892
SHA1

fb0798070cd9d11123f458a22a0d6fdad5886339
SHA256

3e92efb8de737220cbc5017a56eabd78612c33256fef1abe82b11b68e13e472a
SHA512

78cd236e21e892b38832af815b9f439bfd07f39b739f6944fc6385e57e053b5c5f4038e7ae3e6686392d319d3bab2120ce40eb864f089cb1e7f6478cc0fc0b4e
SSDEEP

6144:V/jZqQdFr7BQ1sWUT2rqX1qSVt7j4TbRhIUn8zsdZNfB/vDP3u:V/jQMFKKQrGRt34vpy+D5vDP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	4660	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b8b6f052ed5048f3c0c824f12f8c892_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8b8b6f052ed5048f3c0c824f12f8c892_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8b8b6f052ed5048f3c0c824f12f8c892_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 544
  2⤵
  - Program crash
  PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4660 -ip 4660
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4660-0-0x0000000000630000-0x0000000000632000-memory.dmp

Filesize
8KB

Download
memory/4660-1-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download