db43179a7adeab2bd931d56bd6aa63fdcfe2e7c640fc0df57d5e99d5cb885e2a

Analysis

max time kernel
103s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db3d83fa072dc1352755227c128f38ed_JaffaCakes118.exe
Size

385KB
MD5

db3d83fa072dc1352755227c128f38ed
SHA1

bc84c9a244cf69d05f46015232ba156b913b7856
SHA256

db43179a7adeab2bd931d56bd6aa63fdcfe2e7c640fc0df57d5e99d5cb885e2a
SHA512

e32b6c2e0dc31b2bf77d8cc8981cbcc036fbfb3569a04d01f95a4447df50f4a7f853530d87d331681b3594a9562e645aaa2f04ed58b8f5dd8f93aac726c7eb5b
SSDEEP

12288:Uu2NeTEcd+fZGuSUsPabR90y8J6gd7w+3vLa+PL:z28d+ZL8JZd7Z3zdPL

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	1700	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db3d83fa072dc1352755227c128f38ed_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\db3d83fa072dc1352755227c128f38ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db3d83fa072dc1352755227c128f38ed_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 224
  2⤵
  - Program crash
  PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1700 -ip 1700
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x0000000001000000-0x00000000010C6200-memory.dmp

Filesize
792KB

Download
memory/1700-1-0x0000000001000000-0x00000000010C6200-memory.dmp

Filesize
792KB

Download