66f6466a42f5da7057a20e915c3342043a87aee43c5002c6ab42fcbce8666e50

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8e1a05c7046ecce4308115962379c4_JaffaCakes118.exe
Size

119KB
MD5

ea8e1a05c7046ecce4308115962379c4
SHA1

4d3d3beaf053f67b1ccf87a6a657d73be45749c8
SHA256

66f6466a42f5da7057a20e915c3342043a87aee43c5002c6ab42fcbce8666e50
SHA512

f0b07563e93bdf333c9c3104cb8b7d700235cfdf83b58a611df74db0491b92f9249b46a21a7a6b02018019c30e5cf08079df91f75ea565536f7eedc38754b99b
SSDEEP

3072:AV4rjJoKzaT2B/yHbxr78/bLdZzp2LOsGLZaU9D:iqJXxykoSssz

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gtmfns\ulq	ea8e1a05c7046ecce4308115962379c4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gtmfns\ulq	ea8e1a05c7046ecce4308115962379c4_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	2280	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea8e1a05c7046ecce4308115962379c4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ea8e1a05c7046ecce4308115962379c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea8e1a05c7046ecce4308115962379c4_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 420
  2⤵
  - Program crash
  PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2280 -ip 2280
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download