7157e1469a315f2cfc8c38ee03a5c4d025428fba40a5cecc4859a9c3616265f8

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d19f3dd50776ce064e2a665287682f6_JaffaCakes118.exe
Size

163KB
MD5

8d19f3dd50776ce064e2a665287682f6
SHA1

599fe3a97d9c3290a6d4f202fd251f605f5c1127
SHA256

7157e1469a315f2cfc8c38ee03a5c4d025428fba40a5cecc4859a9c3616265f8
SHA512

3497b1bd37ee46ad13a22e0fbf3a5737ffbd5ba94457a50c24bbd33728275001f7e2df3829b60af34b886ab70fc55fb697b60ce9fad74a261739cfa2c8b08164
SSDEEP

3072:3y+kOL/10H3UnADB/h/OwHdGBjIWVCbGHTYJWfl1iX3cO4e/P86rWiIaLHp066gV:3f+HHewAMWV1HTtrIcg

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	2680	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d19f3dd50776ce064e2a665287682f6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8d19f3dd50776ce064e2a665287682f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d19f3dd50776ce064e2a665287682f6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 1236
  2⤵
  - Program crash
  PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2680 -ip 2680
1⤵
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\text.txt

Filesize
4KB

MD5
ef7b8fc0d77085b0ad9fb5aad5736d35

SHA1
7b5abc77d730544c82f469c5e181f220a21c7574

SHA256
ef929da4856b72f9d56c3af9cc0c7164beff0016446b139f64746bf8bd9e9aed

SHA512
fadb575e6abf1699dd0358d4fe0524d4c50008d168d90fb15aa7a93698e5410142bf899202c4aa32d962cac786b666126eec3ebdff21ec029015b9bf3c52ebb2

Download Submit