477d9deb21692b80a454f0a9794d0fafc13b5d5e60b271ef46787d9843f3f2df

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a59d4ed30a0353f69cce57ad83831ea_JaffaCakes118.exe
Size

556KB
MD5

2a59d4ed30a0353f69cce57ad83831ea
SHA1

b2d39bf9a8cdc4d04d813693885b73d20d315b30
SHA256

477d9deb21692b80a454f0a9794d0fafc13b5d5e60b271ef46787d9843f3f2df
SHA512

df7ae3b549e78828ba75196ae4e981a5b3feaa2d46a0b6692f659d5345353f47571a6f67ce95065b288254ea04063732d3c6763185d02afa6cba5865876ec3d6
SSDEEP

12288:tTiCMTiZkq8ul2j9rt5ELxL3Z4gO+GW67IAteL2SLudbHv4xMLtAYkDAC:FiNTkkqjl2j9rt5ELp3Z4NW67p3Z4xmC

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	5004	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a59d4ed30a0353f69cce57ad83831ea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2a59d4ed30a0353f69cce57ad83831ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a59d4ed30a0353f69cce57ad83831ea_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 440
  2⤵
  - Program crash
  PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5004 -ip 5004
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5004-0-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download