b5ea8b8091cd6905cdef412cf205b5d6f824fa75685041f92bee5391550bc59c

Analysis

max time kernel
137s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

948de7c73b264efb01cd21bb2e15fefe_JaffaCakes118.exe
Size

19KB
MD5

948de7c73b264efb01cd21bb2e15fefe
SHA1

eea58f3782be13269161a89b4bb6e62422f6d09b
SHA256

b5ea8b8091cd6905cdef412cf205b5d6f824fa75685041f92bee5391550bc59c
SHA512

9b07d1431abd6a113c7d1d36b31c488cad14d6db2dd8050771897810420cc93afd313ccda68945102179422774a15dedd98b773f41ee665a4a5a9ebe2dc9c70f
SSDEEP

384:VG9Hna01GVeDi8O3RZimX8KJ/otZus7ndRR/in0/be+P4d+:mHlhGX1B6NjdRZi0CZ4

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
368	768	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	948de7c73b264efb01cd21bb2e15fefe_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\948de7c73b264efb01cd21bb2e15fefe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\948de7c73b264efb01cd21bb2e15fefe_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 224
  2⤵
  - Program crash
  PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 768 -ip 768
1⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4388,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-0-0x0000000000400000-0x000000000043A34A-memory.dmp

Filesize
232KB

Download
memory/768-1-0x0000000000400000-0x000000000043A34A-memory.dmp

Filesize
232KB

Download