f12ae62349163090333d0816c9855feb596b779a46239b41cba979e5505d8a6c

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afba3e1e446d7a6320c2c441b560613d_JaffaCakes118.exe
Size

290KB
MD5

afba3e1e446d7a6320c2c441b560613d
SHA1

f662fc6d6c70b7f872a300d77b2ea9ccf3e43a98
SHA256

f12ae62349163090333d0816c9855feb596b779a46239b41cba979e5505d8a6c
SHA512

1467823008e87a81120437e2b25e12a3b7ef5c070267866a80db7a4d4a950c58e0a698ac28deaad7f82137eb9e7344531c340875980873442a124060646c95c6
SSDEEP

6144:gfs6V09Du+Rc9DMQtc9LMojzmx1i68Nbe67pkkDvarOdYLx3IhpD:kX2C9DGh1wi6AeephDvfY13QpD

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	4148	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afba3e1e446d7a6320c2c441b560613d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\afba3e1e446d7a6320c2c441b560613d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\afba3e1e446d7a6320c2c441b560613d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 532
  2⤵
  - Program crash
  PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4148 -ip 4148
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4148-0-0x0000000002200000-0x0000000002241000-memory.dmp

Filesize
260KB

Download
memory/4148-1-0x0000000002200000-0x0000000002241000-memory.dmp

Filesize
260KB

Download