f0c67affa00f6aa229b34e75ba823b56393132f223e132e5139b14c7a33b9b60

Analysis

max time kernel
129s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab15ec331bfc3ff1c239bec13079cdac_JaffaCakes118.exe
Size

752KB
MD5

ab15ec331bfc3ff1c239bec13079cdac
SHA1

754d4099550b86debe7b6c8cc416bd6b9ff7821a
SHA256

f0c67affa00f6aa229b34e75ba823b56393132f223e132e5139b14c7a33b9b60
SHA512

98e27a925d5a901b80d96558789bd194854128248e3a52bb5a15d3f1d926f0aa40ef1bef5cbf57041f859e6d9f763b8990b5178e04bd497532c346cbe4ad472e
SSDEEP

12288:TJUmWY78w3IZl/qJyxR0qVtprVpr8yrfOkVWhWo/+BbADltb4TAsaPLoE6aKKh3u:lUmr7EWJy/VVtprVGyrfOCWAow2NMgLY

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
368	412	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab15ec331bfc3ff1c239bec13079cdac_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ab15ec331bfc3ff1c239bec13079cdac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab15ec331bfc3ff1c239bec13079cdac_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 408
  2⤵
  - Program crash
  PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 412 -ip 412
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-0-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/412-1-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download