57409e553883b92c1a0acfc0a5707609de81465fc32cac91b75a35bfd859dccf

Analysis

max time kernel
92s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_06a5230382e309c64b581c6d43d474fb.exe
Size

93KB
MD5

06a5230382e309c64b581c6d43d474fb
SHA1

4a6ce4e129efac1ebae7045edfbb394f4e662b80
SHA256

57409e553883b92c1a0acfc0a5707609de81465fc32cac91b75a35bfd859dccf
SHA512

5fd7017702c6c3a90243ebda38103ed15c1ff813296ab189d23db5b2b3674d414d8bd9d0076a0c0da3efe3c174120330735d42e5824ab60129bf6407354460e9
SSDEEP

1536:ESY/8eN3BeyOdmrDOir4i/cyM9goCnPfhfLm/84MPnaaaaaaaaaaaaaaaaaaaaa1:jY/8Abdf3r4YpM9YPZzDnaaaaaaaaaaI

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	3780	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_06a5230382e309c64b581c6d43d474fb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3780	JaffaCakes118_06a5230382e309c64b581c6d43d474fb.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a5230382e309c64b581c6d43d474fb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a5230382e309c64b581c6d43d474fb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 496
  2⤵
  - Program crash
  PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3780 -ip 3780
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3780-2-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/3780-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3780-4-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3780-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download