02b14deac1bf148f8ab33033afaf725ba7e22ae7f2949cafbd1e8c0f7457ebf8

Analysis

max time kernel
101s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f40bcc7d791a4ce3d2badfbd75baf4ff_JaffaCakes118.exe
Size

760KB
MD5

f40bcc7d791a4ce3d2badfbd75baf4ff
SHA1

92fb2abcbfdca696e09cfb1a10c1e57985982eb7
SHA256

02b14deac1bf148f8ab33033afaf725ba7e22ae7f2949cafbd1e8c0f7457ebf8
SHA512

8f984a9852b6b76568481ae9b778865e2f69ae8af9de21c0a340e5f73ec3fe033447c8f455c9772f4cca371adb573b003a49cb12df58922d2b299ee51a0c3110
SSDEEP

12288:0CSZvFBs+KC2G18gGzcj9vtjFFV8YBGo/haRsLJhWeDa+m2zKOwxbbJxXAfk:AZv8A1zBtjFFVWKhaRSWeDa+mSwPxXv

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4456	1620	WerFault.exe	81
620	1620	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f40bcc7d791a4ce3d2badfbd75baf4ff_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f40bcc7d791a4ce3d2badfbd75baf4ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f40bcc7d791a4ce3d2badfbd75baf4ff_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 224
  2⤵
  - Program crash
  PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 228
  2⤵
  - Program crash
  PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1620 -ip 1620
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1620 -ip 1620
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1620-1-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download