d313ec5d1936537c489f033da9bdc97ac3e614fb1057112dadd431000c19540b

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08aa35ba43a5ade8e62cb98c47717116_JaffaCakes118.exe
Size

61KB
MD5

08aa35ba43a5ade8e62cb98c47717116
SHA1

a1ecb84c58a61daf3149c154e7d3e034711d28aa
SHA256

d313ec5d1936537c489f033da9bdc97ac3e614fb1057112dadd431000c19540b
SHA512

8677faab3234769e61a3ffc73f0bb1dbb880f7fc3db40092e8c9509c9015278262e3e2f02fdcf356c90b1c440c2aeefc5ac4691dcbba73bcb3f4d36364b324fa
SSDEEP

1536:t1UmxIyYclkOZB4NgbeG/H4m5u1FaeeSisKldl8TF+VTAi2R:Yy28C2bD/H4m5u1EdJsw5i

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	1920	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08aa35ba43a5ade8e62cb98c47717116_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\08aa35ba43a5ade8e62cb98c47717116_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08aa35ba43a5ade8e62cb98c47717116_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 440
  2⤵
  - Program crash
  PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1920 -ip 1920
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-0-0x0000000030000000-0x000000003002F000-memory.dmp

Filesize
188KB

Download
memory/1920-1-0x0000000030000000-0x000000003002F000-memory.dmp

Filesize
188KB

Download