a12bd76e7185b8c10e24004724672cf475b5d0e9b4a5c74cf66be0b727e30a5b

Analysis

max time kernel
95s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

181844a7f0b4c1a1d7a52ba2238e651e_JaffaCakes118.exe
Size

410KB
MD5

181844a7f0b4c1a1d7a52ba2238e651e
SHA1

0a99de73fd61f15986f54c45e134f4594296f2b5
SHA256

a12bd76e7185b8c10e24004724672cf475b5d0e9b4a5c74cf66be0b727e30a5b
SHA512

adb184e1647969a1e9e9f37f22c0ba48bb381faa266afdc4c0007593deeb85fe9c3df9b13bc0dbdee5f8f4bb596de7db6d5eb3bd018128ea5a8b47466acdb6c2
SSDEEP

6144:NBeHVsQ4FUogCKSUfVYkQ6WawS7T/LiCwIzH1x5XMTImRpYcKYFQ1WW+tL26/:veHCQ+gQgY6WWXB7r5kDhGYz

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	4332	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	181844a7f0b4c1a1d7a52ba2238e651e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\181844a7f0b4c1a1d7a52ba2238e651e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\181844a7f0b4c1a1d7a52ba2238e651e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 220
  2⤵
  - Program crash
  PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4332 -ip 4332
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4332-0-0x0000000000010000-0x000000000102C000-memory.dmp

Filesize
16.1MB

Download
memory/4332-1-0x0000000000010000-0x000000000102C000-memory.dmp

Filesize
16.1MB

Download