f5ca52be97f865fb85c40793e6258f26b30809b1ca05695646f1288cb5e5edaa

Analysis

max time kernel
93s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a048e535b98ba3063d379562643f8f2a_JaffaCakes118.exe
Size

114KB
MD5

a048e535b98ba3063d379562643f8f2a
SHA1

2c4b2e8a5bc5c86d45aa472ddfa9c263c727a58d
SHA256

f5ca52be97f865fb85c40793e6258f26b30809b1ca05695646f1288cb5e5edaa
SHA512

d97f6043bb3ca4481b24fd28fbb25c85cc18e51d4f2d4fcddff1494b6f5b451829a8b336bc3a2de6b91844a9c83b883180e6d7fea882e4303d7c631705c0eb23
SSDEEP

3072:caBwZ6WPW1Eat9V5KWL1lfNO79/DMeVGh3OAne1iFkRcOYnlZi:caBwgQWKc7T5NKdDM6k3re

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4004	1492	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a048e535b98ba3063d379562643f8f2a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a048e535b98ba3063d379562643f8f2a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a048e535b98ba3063d379562643f8f2a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 500
  2⤵
  - Program crash
  PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1492 -ip 1492
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-0-0x0000000002030000-0x0000000002049000-memory.dmp

Filesize
100KB

Download
memory/1492-1-0x0000000002030000-0x0000000002049000-memory.dmp

Filesize
100KB

Download