ea2a1bed281cd7e7cdd5463be630088edcc8bfdcd0eb16c60c364423fee3dc4e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0513a431b182465d89de5faacdb3d951_JaffaCakes118.exe
Size

42KB
MD5

0513a431b182465d89de5faacdb3d951
SHA1

da831b480ff2c8c78cbf40b62011fee10fa4e773
SHA256

ea2a1bed281cd7e7cdd5463be630088edcc8bfdcd0eb16c60c364423fee3dc4e
SHA512

77c7a02d669c2772aef9ce71e6ee865524f0354f620aa8142304650257fc47941f8920ebf79de87e9327026f5cafbe8e78c428304a198e3e163becee8dce81c4
SSDEEP

768:LAkCvqyQj/mOcwsRWwbggt5g6UUWdG92W049c1Vb5nBOHhTemRiqoYnrqtDFx87t:LAzvqyQj/mrW+r/gZt1Vb70emL2xFx8Z

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	4488	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0513a431b182465d89de5faacdb3d951_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0513a431b182465d89de5faacdb3d951_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0513a431b182465d89de5faacdb3d951_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 408
  2⤵
  - Program crash
  PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4488 -ip 4488
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4488-0-0x0000000000400000-0x00000000007E2000-memory.dmp

Filesize
3.9MB

Download