e4b8f81ab01b294dddb4702e323dabcc7810080c35d07e469daab5a089dd7fbb

Analysis

max time kernel
99s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cde55d6d3510f66c5180774c802d2a0_JaffaCakes118.exe
Size

107KB
MD5

0cde55d6d3510f66c5180774c802d2a0
SHA1

2c2dfdca135e896077d393b4e4a6efd4502743ac
SHA256

e4b8f81ab01b294dddb4702e323dabcc7810080c35d07e469daab5a089dd7fbb
SHA512

6ba656674a816dc01fb9024b117afe6e8ce24a0ab35444594e6a80b3732efb3c769feef38a77f29041f64e1f43cc7cad747839558b598e66fb0d30e406a4f0de
SSDEEP

3072:li6G7iGRNYCZ3C0cDVZ/PLXaOFxYct0gB1Ds16:8i6TZ3C/jPLuIXx

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	208	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cde55d6d3510f66c5180774c802d2a0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0cde55d6d3510f66c5180774c802d2a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cde55d6d3510f66c5180774c802d2a0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 292
  2⤵
  - Program crash
  PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/208-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download