Analysis
-
max time kernel
144s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 22:44
Static task
static1
Behavioral task
behavioral1
Sample
a883bf052830ed297f1e045d49ec2569_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a883bf052830ed297f1e045d49ec2569_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a883bf052830ed297f1e045d49ec2569_JaffaCakes118.exe
-
Size
32KB
-
MD5
a883bf052830ed297f1e045d49ec2569
-
SHA1
32acad761962c1e05e74279aa8905ff59c5c6a9a
-
SHA256
f16d961de6968eabd1ee8e904319952f958c7d72da6652457ab682eaacc97fc8
-
SHA512
402653569225be6b2dd27da5c4887864a1943fcdbf5ce4c08def6278289a5d9c8afb6160f2d194d1fd3e50ff651ea45a219931467d5df3c18c070f1dd2f371a8
-
SSDEEP
192:UZGei6UxAXMZt6RcsoXHukPVSZ/8BqaIaXQgsIWjI6Es813lMmZ9Ehvcw:UoZ6UxAy2csoektKevs1w36mZWlc
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 2708 1412 WerFault.exe 83 5084 1412 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a883bf052830ed297f1e045d49ec2569_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a883bf052830ed297f1e045d49ec2569_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a883bf052830ed297f1e045d49ec2569_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 2602⤵
- Program crash
PID:2708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 2642⤵
- Program crash
PID:5084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1412 -ip 14121⤵PID:4224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1412 -ip 14121⤵PID:5068