0e99e84e22e352b6f8e8c8272ed6f41d99ede6cf3f56c62a41d351a2dbf9748b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b30032f2a084dc7f937555539f5e649b_JaffaCakes118.exe
Size

46KB
MD5

b30032f2a084dc7f937555539f5e649b
SHA1

1ba4b467a69e3e0c6772ae4b6d499f17e5e46fc2
SHA256

0e99e84e22e352b6f8e8c8272ed6f41d99ede6cf3f56c62a41d351a2dbf9748b
SHA512

c45a6f8281faeb7af40021e107973be3bf9eeae16c13fcd1a45bb37c49c3eb471e7ea5654594649217d12e4421e3d234bdebad26d96c46381d1ea25054a944ea
SSDEEP

768:mU2dAxuU2vNh/558m783K3yZVNHsGkAnqDIWj2WUr8ji80q:mU2Sxu9B5WmQ6sgP3+8f

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	4176	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b30032f2a084dc7f937555539f5e649b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b30032f2a084dc7f937555539f5e649b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b30032f2a084dc7f937555539f5e649b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 372
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4176 -ip 4176
1⤵
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4176-0-0x00000000005C0000-0x00000000005C3000-memory.dmp

Filesize
12KB

Download