0bc4eae257b0ab876ea6b96319b5809b46517d5904f49bfe62eaa6615ff2afb1

Analysis

max time kernel
135s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b271d98592aec95067dd025c2c78255e_JaffaCakes118.exe
Size

448KB
MD5

b271d98592aec95067dd025c2c78255e
SHA1

6a104dab4c571a6ab89cc4cbd8a7f50d49135fc0
SHA256

0bc4eae257b0ab876ea6b96319b5809b46517d5904f49bfe62eaa6615ff2afb1
SHA512

a2b44d6372bb274042b32d543d479b3e5cb48a687e44a3da1fa4b21a65e6116b01fd3899f5b95085336ece5e5f670f3c7ffac780eef4d242b6fa138e1e9fd46a
SSDEEP

12288:QypVSnM6j93gHbknJXScFTZAAjjZP249saBq:npVpwNEV2A2ZhXBq

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	1828	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b271d98592aec95067dd025c2c78255e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b271d98592aec95067dd025c2c78255e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b271d98592aec95067dd025c2c78255e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 548
  2⤵
  - Program crash
  PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1828 -ip 1828
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-0-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1828-1-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download