78dbb664e2867fcd227510cf53111638990a15fe792ea04641f10aa9fcff1258

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce2dba593ed3afedfa00a8de8887ec8b_JaffaCakes118.exe
Size 140KB
Sample240905-3tr9esvcmj
SHA256 78dbb664e2867fcd227510cf53111638990a15fe792ea04641f10aa9fcff1258
MD5 ce2dba593ed3afedfa00a8de8887ec8b
SHA1 6b3013cd9d10b9f20b418854f1363294e23ba7a4
SHA512 a24684aecbe0bb05c5f6a0dcca744133cb35277236563d710bbea12860ba0d7a858cb74e31ffae829a9786224f8d8ac4d4d99f2ebb1a0612680c7243f7c69fe9
SSDEEP 3072:ZBWePozVRNzRMMTTpN28eNuvOkkFPl88bu28f:ZBNQ1PTH2FNDJ2Eu2s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	232	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce2dba593ed3afedfa00a8de8887ec8b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ce2dba593ed3afedfa00a8de8887ec8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce2dba593ed3afedfa00a8de8887ec8b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 248
  2⤵
  - Program crash
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 232
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/232-7-0x00000000006D0000-0x00000000007D0000-memory.dmp

Download