43ae4936dd7f0e4408a759c9880250f94b048851c70a45bd88c478183e2e0728

Analysis

max time kernel
130s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2024 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a066e357131731dd27e06a23667d527f_JaffaCakes118.exe
Size

333KB
MD5

a066e357131731dd27e06a23667d527f
SHA1

53238f05e48c848103b021138799b2d474fc50dd
SHA256

43ae4936dd7f0e4408a759c9880250f94b048851c70a45bd88c478183e2e0728
SHA512

657273d4d3e8209f14daeca9c6baf0d781e0e0eea26e37e1064282c8f847640e2a3b4b910aabdca0a70aceab0f493438b8d853308e055f1bd2fea08f9bd06801
SSDEEP

6144:i80UKaRzEfCGF16F1xx+rHMYbvcOdNS0KCGOgmLArll67y0vAbGRB1zeV:i80UKaRI316Dxxsxvck6Ogm6ll62oRj2

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	2964	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a066e357131731dd27e06a23667d527f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a066e357131731dd27e06a23667d527f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a066e357131731dd27e06a23667d527f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 524
  2⤵
  - Program crash
  PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2964 -ip 2964
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000000660000-0x00000000006A2000-memory.dmp

Filesize
264KB

Download
memory/2964-1-0x0000000000660000-0x00000000006A2000-memory.dmp

Filesize
264KB

Download