e53c983865b62999ed9d9b191e82f63ba1fd6edb6aad69936a97c845bed1e636

Analysis

max time kernel
96s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1bc19d6f27a526539bcd275a3d8e1fd_JaffaCakes118.exe
Size

104KB
MD5

d1bc19d6f27a526539bcd275a3d8e1fd
SHA1

4adccadbe9319876f7eec3b0551201c4863d45f6
SHA256

e53c983865b62999ed9d9b191e82f63ba1fd6edb6aad69936a97c845bed1e636
SHA512

a7274934a0475a371d9479e9ee18a15e31a5b5ab85c3bf155d6633dda4cc9917566e6be4c8d0d0be4d17f39d0d7064f2e3d13174e85258312d67d6a1c6b613ea
SSDEEP

1536:or6R9ieUOc+/RAhDcaPLXbbsAyQIrZBQlgSJ0TWSnisvld1a:26R8Y6hDaAyQIrZBbSJKFxa

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3932	2900	WerFault.exe	82
2064	2900	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1bc19d6f27a526539bcd275a3d8e1fd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d1bc19d6f27a526539bcd275a3d8e1fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1bc19d6f27a526539bcd275a3d8e1fd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 328
  2⤵
  - Program crash
  PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 352
  2⤵
  - Program crash
  PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2900 -ip 2900
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2900 -ip 2900
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2900-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download