a748becdb2c21697c7bdc39cb2bad24c3cb3ecb20e432b1878fa9f05bcb74b82

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe
Size

360KB
MD5

3873e9c48611f30cdbdaae2351badd7b
SHA1

ceeb0cb8b6e61cba268c2bf300736979e88ab491
SHA256

a748becdb2c21697c7bdc39cb2bad24c3cb3ecb20e432b1878fa9f05bcb74b82
SHA512

0ccfdf2e5cb5ed44ffb777e1c61ced77262145d6e93332a3dfac631b4999203e4ef8e3b6274bd4abd9a6de2ec8da1f1e90886be32ceac5b9214458ec6b84c369
SSDEEP

6144:ZC7EO2S2Hu4uN6AOnToEN0lPBTEgFqE0tIjrUB4UKBIkvc2RRVIZd:ZwD2SEuN6pc3PBwxE0Ojox6Ioc2RRVIf

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4048 2736 WerFault.exe 3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe

pid	pid_target	process	target process
4048	2736	WerFault.exe	3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3873e9c48611f30cdbdaae2351badd7b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 540
  2⤵
  - Program crash
  PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2736 -ip 2736
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-0-0x00000000022C0000-0x00000000022EF000-memory.dmp

Filesize
188KB

Download
memory/2736-1-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download