e2b8d71c62b1f37b3ca541d7fdf653088be5a6b7a2c9668a291435736e6e20bf

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe
Size

296KB
MD5

b45ace4af7f1e3cd1615851889a2e990
SHA1

16bb96c5ea8f6832dc2b1d8453364247f7b6dd1c
SHA256

e2b8d71c62b1f37b3ca541d7fdf653088be5a6b7a2c9668a291435736e6e20bf
SHA512

99a01de5eab296aa6f3c3d7f31f1e13a3ade2ff4215ec2d53f80795bfd69cc3d8b7c4f0039433f32085635984386d1d0b3d55eb09a369f4cea7c1573ac1194fb
SSDEEP

6144:tqSVGAkvzwvd1aoVa1rCLJmNR9PCLf7DNkVsuaRaU6mHG:HF1fmCLfF0aRz6mHG

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3272	2516	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 408
  2⤵
  - Program crash
  PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2516 -ip 2516
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2516-1-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download