40a17b2f80d0c6483797cd9c1b61370205c3dedf91d2f8f1d368218aa836e896

Analysis

max time kernel
98s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb0d706affbf6c35cbda9fa434878e97_JaffaCakes118.exe
Size

498KB
MD5

fb0d706affbf6c35cbda9fa434878e97
SHA1

d999ebab7899829b43172335a0cf41932e5f80fc
SHA256

40a17b2f80d0c6483797cd9c1b61370205c3dedf91d2f8f1d368218aa836e896
SHA512

7d1e3dbb47a720b39f950c4cc3e15d863fbc6acced2477da1ba87a7dcbb570ab0147030e652c4f84ce37574577f90257aeb412e0135e6029d09a1b7ba98c14cd
SSDEEP

12288:hKAIBUZJmywOb5esHnNXyNL4r4h/49siPFofw0m8vMZ:hKAVcsestiZm45SvyDra

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3996	4680	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb0d706affbf6c35cbda9fa434878e97_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fb0d706affbf6c35cbda9fa434878e97_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb0d706affbf6c35cbda9fa434878e97_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 340
  2⤵
  - Program crash
  PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4680 -ip 4680
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4680-0-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/4680-2-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4680-1-0x00000000022A0000-0x0000000002300000-memory.dmp

Filesize
384KB

Download