Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:22
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_80c30db2d99ff849295e7c0a8e6924ead10228105d0d675f02c1244ef6bd0106.gz
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_80c30db2d99ff849295e7c0a8e6924ead10228105d0d675f02c1244ef6bd0106.gz
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Orignal Invoice_pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Orignal Invoice_pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
duzcazams.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
duzcazams.exe
Resource
win10v2004-20241007-en
General
-
Target
duzcazams.exe
-
Size
133KB
-
MD5
9cc4b3dcc8a712968339507dfbefa5bc
-
SHA1
5909f209cf93e4365180ac050d663a2076e81af8
-
SHA256
3017920f6f2c95870bf938c2aab1c64e77c9b65e7f8ad7e3d81cdaeb58bacff3
-
SHA512
c5f5955302883578f4899f9250984bcedc375a7f2c1b3e1dd3912a1e334c8f247df757cb94a4ac8ed94918659b22f0070172dfbe0dc9fe567fece22a7b34364e
-
SSDEEP
3072:5DCsPEvMCi32nCnQCqTJhtvjRwDOAa00LSAQzM3JDH:Z9PkKuDTJrFwD5eH
Malware Config
Signatures
-
Program crash 3 IoCs
pid pid_target Process procid_target 2756 3672 WerFault.exe 82 4684 3672 WerFault.exe 82 2804 3672 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language duzcazams.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\duzcazams.exe"C:\Users\Admin\AppData\Local\Temp\duzcazams.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 6602⤵
- Program crash
PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 6602⤵
- Program crash
PID:4684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 6562⤵
- Program crash
PID:2804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3672 -ip 36721⤵PID:3476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3672 -ip 36721⤵PID:4252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3672 -ip 36721⤵PID:3500