50a60fdf160af70aff8aa7a1c3ff2d5df950221e70e630f42d7728c138f98c20

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd9afd05e2588e12464f909e9eef09e3_JaffaCakes118.exe
Size

3.3MB
MD5

dd9afd05e2588e12464f909e9eef09e3
SHA1

015b80bd356ae110a15aeb966bf19bde654eb53f
SHA256

50a60fdf160af70aff8aa7a1c3ff2d5df950221e70e630f42d7728c138f98c20
SHA512

91c74e89a97b601f13e431a79a2eca3bbb5e5cbf66508ed44f28b4e1c8b507c8fce8d5de35d040480f13014602fd652e6d735f0b9b451343e761219cbbecff00
SSDEEP

6144:JHaJJHw4QDiTDXXT5xYQYMfmTjgYhLrrlwnflVBK:EJHtQe1uYfWwBK

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3660	3744	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd9afd05e2588e12464f909e9eef09e3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dd9afd05e2588e12464f909e9eef09e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd9afd05e2588e12464f909e9eef09e3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 268
  2⤵
  - Program crash
  PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3744 -ip 3744
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3744-0-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download