1066d11b5c7f83c404035583c27623ae618b0c329549945e478cdc807199698f

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabd2b4e71f78403052d25e78d989504_JaffaCakes118.exe
Size

460KB
MD5

eabd2b4e71f78403052d25e78d989504
SHA1

ab295926b8d16a0d17933881ac9ff084d6cf6630
SHA256

1066d11b5c7f83c404035583c27623ae618b0c329549945e478cdc807199698f
SHA512

dadd8c31afaa250f2ab81ff3a326b856fb76601ae86d4983fd71a0a226bcb2e62b47da1ca5d12b44146e71114ee1909c05154d04b3990f2683a2c34116fb4200
SSDEEP

6144:QHDQCQ1V/9AOdUK+pXr8EFV2vGhisi6E6OQVRa/qWnPja0kLafF6sm6RhHWFW:Qmt9AO8Xr9NhimOgWba0hfm6Rh2

Score

3^/10

discovery

Malware Config

Signatures

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4812	1496	WerFault.exe	88
4044	1496	WerFault.exe	88
2992	1496	WerFault.exe	88
768	1496	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabd2b4e71f78403052d25e78d989504_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eabd2b4e71f78403052d25e78d989504_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eabd2b4e71f78403052d25e78d989504_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 512
  2⤵
  - Program crash
  PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 532
  2⤵
  - Program crash
  PID:4044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 552
  2⤵
  - Program crash
  PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 476
  2⤵
  - Program crash
  PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1496 -ip 1496
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1496 -ip 1496
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1496 -ip 1496
1⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1496 -ip 1496
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-1-0x00000000006C0000-0x00000000007C0000-memory.dmp

Filesize
1024KB

Download
memory/1496-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1496-3-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1496-4-0x00000000006C0000-0x00000000007C0000-memory.dmp

Filesize
1024KB

Download
memory/1496-6-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1496-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1496-10-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1496-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download