5c5f537f6abc510a8d429d7210f8449902cf19a14a703acdcb9e924977941089

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa69c2a3367112de853351d3c867f54a_JaffaCakes118.exe
Size

53KB
MD5

fa69c2a3367112de853351d3c867f54a
SHA1

23e9ab361980d449fadcf2d5601412f45c1bf8c1
SHA256

5c5f537f6abc510a8d429d7210f8449902cf19a14a703acdcb9e924977941089
SHA512

cc3743306e3d41cacde5f93ab8c7c22ba615b8b916b5da1234df40dc9570ea104ae51a38197eb46b5c28c7e8b05e12f19ad7cc01dad56eb3b9811ed6e24916b9
SSDEEP

1536:01+4eWxgXFyNafw8R8Dxo9f6PAqZOd1B:0c4esgFeafiS9iPA7nB

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4908	4844	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa69c2a3367112de853351d3c867f54a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fa69c2a3367112de853351d3c867f54a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa69c2a3367112de853351d3c867f54a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 224
  2⤵
  - Program crash
  PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4844 -ip 4844
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4844-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download