d6f6a0383b1718a3b01d1f1792301c232228299fe11a6ca214b96110c8b1b9a2

Analysis

max time kernel
140s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0fa6222a55b7ba690a484d630455239_JaffaCakes118.exe
Size

1.1MB
MD5

d0fa6222a55b7ba690a484d630455239
SHA1

3ae88611e5da15e203ee1329aea793eaaa432eb0
SHA256

d6f6a0383b1718a3b01d1f1792301c232228299fe11a6ca214b96110c8b1b9a2
SHA512

00a4eb5600af4262dd4d5e31b0a67ba612280830e437c9bab25c3cc2082157f3af7c935e3c526202999fd7efc630153e6143ea30c6ba5bb89e524de3165708a3
SSDEEP

24576:a32p3d+HGF4oWaijCE7UDWEX8KUC+YW17:amBoaCCQU+1vY4

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3936	3212	WerFault.exe	82
4688	3212	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0fa6222a55b7ba690a484d630455239_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	d0fa6222a55b7ba690a484d630455239_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	d0fa6222a55b7ba690a484d630455239_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	d0fa6222a55b7ba690a484d630455239_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d0fa6222a55b7ba690a484d630455239_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0fa6222a55b7ba690a484d630455239_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 632
  2⤵
  - Program crash
  PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 616
  2⤵
  - Program crash
  PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3212 -ip 3212
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3212 -ip 3212
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3212-0-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/3212-1-0x00000000005F1000-0x00000000005F2000-memory.dmp

Filesize
4KB

Download
memory/3212-3-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/3212-2-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/3212-4-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/3212-5-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/3212-6-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/3212-7-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/3212-8-0x00000000005F1000-0x00000000005F2000-memory.dmp

Filesize
4KB

Download