5500150e3491dbda37f1f4d5aece926b88cedb6d726615d5e0484ede8d3518f0

Analysis

max time kernel
93s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea951bc612b34de24a139cbf6755e4e6_JaffaCakes118.exe
Size

948KB
MD5

ea951bc612b34de24a139cbf6755e4e6
SHA1

719effbae989726127ec2f455a73f6cb766203e7
SHA256

5500150e3491dbda37f1f4d5aece926b88cedb6d726615d5e0484ede8d3518f0
SHA512

2a04740077722f7908a421444e737a1d7e66fbcbe6f58cf0b518d1d26ddaabc887850def0563dc3ccc741754c0b4ef9a85dbaa7334bdb6e106fb506489431693
SSDEEP

12288:wy1JMQzmBN689+naXV9QOi8PSyKFYyi7wxo1c2obY7Rx6bEel4p8gKi:j17zo5LDQOXOizocV+Exp

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3600	4348	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea951bc612b34de24a139cbf6755e4e6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ea951bc612b34de24a139cbf6755e4e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea951bc612b34de24a139cbf6755e4e6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 232
  2⤵
  - Program crash
  PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4348 -ip 4348
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4348-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download