4082f1fb60e29a9b9b590a584b7500f32306253e44bf07554a266b4473536f44

Analysis

max time kernel
94s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d575b01bef7a240026416641e7c3e49a_JaffaCakes118.exe
Size

10KB
MD5

d575b01bef7a240026416641e7c3e49a
SHA1

273e214e045a172f826328e45146664ebc7f6062
SHA256

4082f1fb60e29a9b9b590a584b7500f32306253e44bf07554a266b4473536f44
SHA512

6a781b709c0b9f3cc13412dcccfbe45ffcfd5a8aa1b741115da997ee7660749ba86cbbfd4d0cfaf54275b5cd1b33929b1fcfdec3024fc4bed9d2fb76c04c24f1
SSDEEP

192:njwEw25uRaIosFwibWCZN+68LQaa8IPwE0OrT:jz5qZNWC58Lna8V

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3212	3228	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d575b01bef7a240026416641e7c3e49a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d575b01bef7a240026416641e7c3e49a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d575b01bef7a240026416641e7c3e49a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 308
  2⤵
  - Program crash
  PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3228 -ip 3228
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3228-0-0x0000000000400000-0x0000000000409010-memory.dmp

Filesize
36KB

Download
memory/3228-1-0x0000000000400000-0x0000000000409010-memory.dmp

Filesize
36KB

Download