689274857c865531e7b2cada6adf79efe6b421bf290f55bd44920944d330d046

Analysis

max time kernel
94s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe
Size

251KB
MD5

26ecc8c52d076787daf9a1b627639d70
SHA1

02863208de84014a88f8175a555ad7e962ecfdd7
SHA256

689274857c865531e7b2cada6adf79efe6b421bf290f55bd44920944d330d046
SHA512

afd24a115ac2430fa9a8c30c6371151403c6ba41a62dcbd0d9090209c9f72c0dbf42a0c23a59dee10af46b1ee3dd026f34d6819e1a50c6adb0d2665047a78bc6
SSDEEP

6144:h4G9VCVis9LEupKjvjTh3/vo6qPw8CVWnCkHWSVLJCD:hEEieI6klCofHMD

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3740 3852 WerFault.exe 26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe

pid	pid_target	process	target process
3740	3852	WerFault.exe	26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26ecc8c52d076787daf9a1b627639d70_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 512
  2⤵
  - Program crash
  PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3852 -ip 3852
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-0-0x00000000022A0000-0x00000000022CE000-memory.dmp

Filesize
184KB

Download
memory/3852-1-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download