44cc68e03116de75d0c38f690ed6f09513d007422b938025f9933ad2b0239409

Analysis

max time kernel
94s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_63512ecc60dd21d0333b2dc7003f48a0.exe
Size

952KB
MD5

63512ecc60dd21d0333b2dc7003f48a0
SHA1

636af8d4b6b9f19270d33a9bd611c19d153f1a17
SHA256

44cc68e03116de75d0c38f690ed6f09513d007422b938025f9933ad2b0239409
SHA512

bf79d24731c864cda3b756c66c5c4a14aa4601bd2130fbd521ea655e7b398d47337f24b3ad5fb3aa7e550cabc7e1557c5ba4a487a72d3d11c86ae16f3d13c520
SSDEEP

12288:byyy7Z3z4I8NXOGjwwG/ZjXsAHHz79p9NM5Tz103j2CF4TxQUOfhVPOSAE//VAci:baCI2OewFJN4mkxyHnnew1SatLRzD

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2480	540	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_63512ecc60dd21d0333b2dc7003f48a0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
540	JaffaCakes118_63512ecc60dd21d0333b2dc7003f48a0.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63512ecc60dd21d0333b2dc7003f48a0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63512ecc60dd21d0333b2dc7003f48a0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 464
  2⤵
  - Program crash
  PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 540 -ip 540
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-2-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/540-3-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download