cbd589bd0b27a84befb4f8bd187cb842a0ea12a1bc79c507985229188f547220

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe
Size

437KB
MD5

beae90a4c4d0637f34b0c432a292e3d2
SHA1

94d5a653a4010da4f76742dca992239bab4ac4ca
SHA256

cbd589bd0b27a84befb4f8bd187cb842a0ea12a1bc79c507985229188f547220
SHA512

33241e2ad2cf2a9b0c309eaa163868227c6b3d0e9ab039ac3b6b84483de7740f6ebbf86489b6c2a65ff08e5d1671a199cc7b1f9c985691edb62c2090f0f644bb
SSDEEP

12288:OEC1Fo9faQp++gs7s7ytNr72gUxNBRh9:r9f/pMMs78UbB

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2204 2552 WerFault.exe beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe

pid	pid_target	process	target process
2204	2552	WerFault.exe	beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\beae90a4c4d0637f34b0c432a292e3d2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 416
  2⤵
  - Program crash
  PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2552 -ip 2552
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads