93b67e8549f519f940b379d4509d2e3f2ec8bc812252f0a141120062316b2d20

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb91e76821ac6ea5bf6081f6eae44f12_JaffaCakes118.exe
Size

46KB
MD5

bb91e76821ac6ea5bf6081f6eae44f12
SHA1

5b7ca07c52bce52bad6087f91129db6100cecc30
SHA256

93b67e8549f519f940b379d4509d2e3f2ec8bc812252f0a141120062316b2d20
SHA512

9cc1e61b368afc5c5baca53ef7b02954fd470c799c576762e9fadd739cf197f51a58392e4f8fefa7eeea05ed2a85c93a0f9d49058755488170526ad7fa11670f
SSDEEP

768:N0yZ9pQiKtPz5l2PYXahnqcS6eC4L269ShZTVuPpYRbwQGaPuUxzGwNtQ0YrSTX4:aytQRPzGnBS6eC4Lb9kTVuxY5mamNwNK

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	3584	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb91e76821ac6ea5bf6081f6eae44f12_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bb91e76821ac6ea5bf6081f6eae44f12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb91e76821ac6ea5bf6081f6eae44f12_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 224
  2⤵
  - Program crash
  PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3584 -ip 3584
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3584-0-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download