47fa5d4e8bce6f3ce9a31f055cf3299d3918b39c6a8929b377672af3445295db

Analysis

max time kernel
139s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7c3c28e5d06e0c053c3e4365cb2ee89_JaffaCakes118.exe
Size

214KB
MD5

c7c3c28e5d06e0c053c3e4365cb2ee89
SHA1

5f74b668ca4ddbba632f5d1bdf652a8d02bc74a8
SHA256

47fa5d4e8bce6f3ce9a31f055cf3299d3918b39c6a8929b377672af3445295db
SHA512

c8ce10389c7e67ee94a0bd156176f37b98f1a8f9f241514ca820592c5bd17f102ef4777fe528a38b4b9ef6ae04cd9524509580e38690523a698ddf5eed2959d6
SSDEEP

6144:ysKiGbMTOKttWufdN9OS0JzMTC9OcWD8nVWCf+xFkEmmx1SP:ysKiGbMTXtpFV0pMTCYDU2FkEmISP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	3328	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7c3c28e5d06e0c053c3e4365cb2ee89_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c7c3c28e5d06e0c053c3e4365cb2ee89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c7c3c28e5d06e0c053c3e4365cb2ee89_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 224
  2⤵
  - Program crash
  PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3328 -ip 3328
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3328-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3328-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download