583ed6739d3c03c9201e12a8b55b28b4ba27cdbf2929355cce544918978970a1

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0ff8d73886711ff149e01b6b1a31bba_JaffaCakes118.exe
Size

132KB
MD5

d0ff8d73886711ff149e01b6b1a31bba
SHA1

79be897e9ae54e90926dcb717a3f6e055cb674d7
SHA256

583ed6739d3c03c9201e12a8b55b28b4ba27cdbf2929355cce544918978970a1
SHA512

953246f6d338ea9be45dec0e1baeb58a8f84d6bb6a045b9440bd97b9135185fc1881a109a77ef5ec396e4a8b938e245d1c9baafbcc23d3c5ca643d48c32b0f26
SSDEEP

3072:RZhgUdbjGSd+XdFXa9br9w5HkmJlrcKjOMktq:RZmSdeD0r9w5HZ7Qqkt

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	4596	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0ff8d73886711ff149e01b6b1a31bba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d0ff8d73886711ff149e01b6b1a31bba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0ff8d73886711ff149e01b6b1a31bba_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 224
  2⤵
  - Program crash
  PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4596 -ip 4596
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4596-0-0x000000000041E000-0x0000000000439000-memory.dmp

Filesize
108KB

Download
memory/4596-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download