498cd3785c735d5bcf6badf4e1b8f72e2bab5081debc2bb3a86a7e16ce5c7677

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe
Size

347KB
MD5

8814517433e0662729b08fd82df7e81d
SHA1

70f2653fa4abe0ec25ad57f87f69b0516afcb346
SHA256

498cd3785c735d5bcf6badf4e1b8f72e2bab5081debc2bb3a86a7e16ce5c7677
SHA512

0a2c13cae4dfce35b04ef2013a4ca9338ee35c54407ca50e474218608a74879c6927e6ba5455fb52dbf380b5b5f2c41fedfe3246d2b2fe9b7554de4806e25456
SSDEEP

6144:jul3JU9DhrPjzXZxOMhb2ZLWc4pPLJahf5WbQlFIJ8WDamSETrNVD2Og0z2Wov:julEhriMYZLWcKPVa5UO6J8Wum9TrX2h

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 4056 WerFault.exe 8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe

pid	pid_target	process	target process
860	4056	WerFault.exe	8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8814517433e0662729b08fd82df7e81d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 492
  2⤵
  - Program crash
  PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4056 -ip 4056
1⤵
PID:372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4056-0-0x00000000022B0000-0x00000000022DF000-memory.dmp

Filesize
188KB

Download
memory/4056-1-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download