9f04a84faa32cde8066da7d34008ec1881c6184e0f4124f7118023dc1e9d81b3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fab8adead809eab2bed313be81fce89a_JaffaCakes118.exe
Size

1.9MB
MD5

fab8adead809eab2bed313be81fce89a
SHA1

bc0c9909f4c6721cbed6382a17d90f10fb4288e4
SHA256

9f04a84faa32cde8066da7d34008ec1881c6184e0f4124f7118023dc1e9d81b3
SHA512

68221ef0b12d9686bc36f80f7bf8c9f30e5ffd243d6bc0e4e5860bfce62e2df38a5cd4d3f419a8a053a35457c17e56e9d0e9eaafb8475a297727c94ab50666fd
SSDEEP

12288:5FfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SbGo4+:5Jcu8pl9d+VdCUhN1SsNK+1pSbZ4+

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	944	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fab8adead809eab2bed313be81fce89a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fab8adead809eab2bed313be81fce89a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fab8adead809eab2bed313be81fce89a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 532
  2⤵
  - Program crash
  PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 944 -ip 944
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/944-1-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download