13c6a865cef050b142acb3c4be63a35198bb99cf1fb3f9fbacbccda64fc723ec

Analysis

max time kernel
84s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a95458432d1b6f486c0eaf66d40d991c_JaffaCakes118.exe
Size

118KB
MD5

a95458432d1b6f486c0eaf66d40d991c
SHA1

692b7e40314bf9092e90ca2e2d358e65bf80b1e1
SHA256

13c6a865cef050b142acb3c4be63a35198bb99cf1fb3f9fbacbccda64fc723ec
SHA512

274f9f6b9fa98affa63e244e8b8a95ea80915e6a8bada9ece6e984de017014bd2f1cd1e068acccd38e1ee6a02612a66515c8af77e11372ffccd00d4a908b009d
SSDEEP

3072:Hze1S6xvQ9kpRICpBXWyqvVh1C7p4rCrKO46fPc:d6BQ6pzLXAtbkp4rAL46fU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	4496	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a95458432d1b6f486c0eaf66d40d991c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4496	a95458432d1b6f486c0eaf66d40d991c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a95458432d1b6f486c0eaf66d40d991c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a95458432d1b6f486c0eaf66d40d991c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 424
  2⤵
  - Program crash
  PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4496 -ip 4496
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads