eaa7d7df865544ae25429e4b0289e90fa7b8dc11fd9b13d548d284993b7277a5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 19:29

Target

689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe
Size

48KB
MD5

689de21147b9991ed9630f86dad1069a
SHA1

ca0c5028ce1fd58609381b3eca77fa17c53fba12
SHA256

eaa7d7df865544ae25429e4b0289e90fa7b8dc11fd9b13d548d284993b7277a5
SHA512

8528d37864986dddeb32ae99ef084e676f8d2e467cd617b0d12208a0c6c5514df3610379ee5118597b5b2c127322a30db611c617053beb3320e53a918eda3893
SSDEEP

768:hUjKVjl9xw3x6nz7vj1wrRFCFFFKjFQ18g0Cj39o:hUKJ3zzj1wXi18diq

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3504	4452	689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe	58
PID 4452 wrote to memory of 3504	4452	689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe	58
PID 4452 wrote to memory of 3504	4452	689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe	58
PID 4452 wrote to memory of 3504	4452	689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe	58
PID 4452 wrote to memory of 3504	4452	689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe	58
PID 4452 wrote to memory of 3504	4452	689de21147b9991ed9630f86dad1069a_JaffaCakes118.exe	58

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3504-2-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3504-4-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/4452-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4452-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4452-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4452-9-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download