eb1915664fbd49451bbdd3a4adcde4863b6d9d5774bc2a6d77a416103a657b0e

Analysis

max time kernel
31s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 08:22

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

954fab721f39c3c3b7173e596f7654e1_JaffaCakes118.exe
Size

330KB
MD5

954fab721f39c3c3b7173e596f7654e1
SHA1

459ba4756e3507dd29290c30011a519a45c53f72
SHA256

eb1915664fbd49451bbdd3a4adcde4863b6d9d5774bc2a6d77a416103a657b0e
SHA512

078ec864265676b17a424787ddfc57b42e7ed8134774424102419ddec34e0bb5d74247704f7d2582833ab8eb48eca75b7a169bf14d9d2cbeadfcbd7e59ccb5c4
SSDEEP

6144:lpy1+JFDG5gyYRvNdr9L/AYlcxGFX//5cp+MXMPVO0voe+3Zb27tn/6rkGSBSaF:lpyYxNRvDrJhXp2zGVO0val2dBSaF

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1572	4772	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	954fab721f39c3c3b7173e596f7654e1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\954fab721f39c3c3b7173e596f7654e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\954fab721f39c3c3b7173e596f7654e1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 492
  2⤵
  - Program crash
  PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4772 -ip 4772
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/4772-1-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download