8186caea49adfbb45e783dfcc5e3c8c30e328ce3383e033475e60ab0c92e1247

Analysis

max time kernel
94s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de919e8bb34955cbbcd20930564e0908_JaffaCakes118.exe
Size

276KB
MD5

de919e8bb34955cbbcd20930564e0908
SHA1

2ac8129ac0e64b989a9c445f909ea6f7a84d795b
SHA256

8186caea49adfbb45e783dfcc5e3c8c30e328ce3383e033475e60ab0c92e1247
SHA512

802a2c25321eae9c8c6115d16e8570f5d6fc96ea99bb030557b312484363bafb495a96641b0050f9d08c44136012732f1ad4ef58d38a17b289007a1a411b738f
SSDEEP

6144:tCFVCW9rUSUa4klU2SC9IZCNkyBr0i51eQwprAvsuA6L:tCFVXrUSCqUFCXNkyBt1e9rAvEY

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	1700	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de919e8bb34955cbbcd20930564e0908_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\de919e8bb34955cbbcd20930564e0908_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de919e8bb34955cbbcd20930564e0908_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 520
  2⤵
  - Program crash
  PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1700 -ip 1700
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x00000000021E0000-0x0000000002221000-memory.dmp

Filesize
260KB

Download
memory/1700-1-0x00000000021E0000-0x0000000002221000-memory.dmp

Filesize
260KB

Download