88fa31a2ce566c6190067b462d7cba5c4c0516f19580f219b425a6a60536ea97

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

136f6e79bbe2ff0a571bd843a2ca5835_JaffaCakes118.exe
Size

214KB
MD5

136f6e79bbe2ff0a571bd843a2ca5835
SHA1

87d03e962ff86d9796744a433e9ab9dad4aa9b59
SHA256

88fa31a2ce566c6190067b462d7cba5c4c0516f19580f219b425a6a60536ea97
SHA512

175cad74d331e141a6c2b97eaad576a74fcc2115ee14c709b00bfe08ba9666781486b0b371c09285b6b7e056b79bab939630717b4bb6de0549276643a745e7de
SSDEEP

6144:/4JN4r/UcpK0da3m2XtBVsQe8df2w7wO0kFP29G8/4Pm:/+N8Ux3m2ve8I5kB2T8

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3544	4920	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	136f6e79bbe2ff0a571bd843a2ca5835_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\136f6e79bbe2ff0a571bd843a2ca5835_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\136f6e79bbe2ff0a571bd843a2ca5835_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 224
  2⤵
  - Program crash
  PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4920 -ip 4920
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4920-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4920-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download