321f3a7a9652bf8dfb99d44b285bbdfb4acc1c065d7682495e7d49f14e1b931e

Analysis

max time kernel
96s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de68a118bce3ab9915f2ae3a3088a4ec_JaffaCakes118.exe
Size

48KB
MD5

de68a118bce3ab9915f2ae3a3088a4ec
SHA1

f1d0dcf45762692f21bfd08ea21d1b8187067cae
SHA256

321f3a7a9652bf8dfb99d44b285bbdfb4acc1c065d7682495e7d49f14e1b931e
SHA512

9ef5c091dbc761b4f2d363db0b1c67b5163184578941a043fdfa5c195e491fcf154f93f85e88ad8f0d91dcee8f9b880f92113ebae776180ba3b8c6717d921ec2
SSDEEP

384:Rw4smM4YoGIrwZQzBsSlIuvG/FqK5hfiBc7JvjP2onGXPtScg27H:W+M4YlhQz2uuf5FiBQJvL2oatScg

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3188	4100	WerFault.exe	82
512	4100	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de68a118bce3ab9915f2ae3a3088a4ec_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\de68a118bce3ab9915f2ae3a3088a4ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de68a118bce3ab9915f2ae3a3088a4ec_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 284
  2⤵
  - Program crash
  PID:3188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 292
  2⤵
  - Program crash
  PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4100 -ip 4100
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4100 -ip 4100
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads