3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3

Analysis

max time kernel
140s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe
Size

329KB
MD5

4307f050fdd98a39e1c38dc1d56abb4a
SHA1

ae3489b94b4a396c82e966de39e49974e84d432c
SHA256

3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3
SHA512

9a55a3109f4fba4270f1c13ba37cf7d8a7114a9bd93c11c3b3f59c02d544c708e3ff55f804497d6cb416dc4fc792f21d18901e0cc17f9369736d805d73fc648b
SSDEEP

6144:3Kzdgl/ZWKOtAObo7zoooocIuFp1rgvW+TrGlbiRenD+uwELn6eVJTOF:ognWvtFoQvmvW8KlshVAG

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1376 1484 WerFault.exe 4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe

pid	pid_target	process	target process
1376	1484	WerFault.exe	4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4307f050fdd98a39e1c38dc1d56abb4a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 480
2⤵
- Program crash
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1484 -ip 1484
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-1-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1484-0-0x0000000002290000-0x00000000022BE000-memory.dmp

Filesize
184KB

Download