d505e3ab20c06778d6164e70ff692f625cae4c013805f885e7cb737c7a6f6764

Analysis

max time kernel
91s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e04b746efc5df53ccec1fcbd86f0aac_JaffaCakes118.exe
Size

522KB
MD5

0e04b746efc5df53ccec1fcbd86f0aac
SHA1

59198c81b9e2fc9a0738f6394bb65e7b82cb740d
SHA256

d505e3ab20c06778d6164e70ff692f625cae4c013805f885e7cb737c7a6f6764
SHA512

d3caf4af51e177b4d51ac32cb0056a943250c8de4ef5cac3799385c56e92f8cb7cc5b077ac540cf739333fba382961207bc790fa485ec549702dacc54ff2e831
SSDEEP

12288:n+GOjcRw0DYuEst3D927BESqwa7MueApF6BU:n+GOwRw0DYuEsHMBESpa7Mueu/

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	4076	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e04b746efc5df53ccec1fcbd86f0aac_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0e04b746efc5df53ccec1fcbd86f0aac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e04b746efc5df53ccec1fcbd86f0aac_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 216
  2⤵
  - Program crash
  PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4076 -ip 4076
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download