af4503b6ae140fc9100ff284a19ad2b38680a74f97d008f52cc2774ff5156c8f

Analysis

max time kernel
136s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c179378005d7e04b6ceb496fde3c399d_JaffaCakes118.exe
Size

151KB
MD5

c179378005d7e04b6ceb496fde3c399d
SHA1

e2560c5b882837c3df39f94e717e02e22f979b68
SHA256

af4503b6ae140fc9100ff284a19ad2b38680a74f97d008f52cc2774ff5156c8f
SHA512

03219794ddb1c34cceb1b6df2cea518b65851544d7bd13517fdbd76e9367c7e067c25fbc59ac40609de1adb61c98efc9cc3cd44742bdba0647044317fb565051
SSDEEP

3072:D3Rdrls+uvmgcT4DpRhBDaRPyTFwQlfbzQU5an7l2TIzXeTnKx:+mD0DpvBD6PVSzz0zXeT

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4320	1488	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c179378005d7e04b6ceb496fde3c399d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c179378005d7e04b6ceb496fde3c399d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c179378005d7e04b6ceb496fde3c399d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 224
  2⤵
  - Program crash
  PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1488 -ip 1488
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1488-1-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download