72f6deb55197965406d82d3e661e48e8fd566771be8f88b0752ef8e7895d6452

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe
Size

452KB
MD5

705585fe9c4b8771bd14bcf835c667f5
SHA1

147f0b9ad07c200d8e58c19fc761eaf4e1f61795
SHA256

72f6deb55197965406d82d3e661e48e8fd566771be8f88b0752ef8e7895d6452
SHA512

9077b4883b731688c80cdd8e32192da234fd3e821a9b08b22a516b09ca6234695e5c985bc82a6916c6afe5d4690716cc766f5ff02ef587c46aa704cc00eb7568
SSDEEP

6144:yY/byWrYzkIg9YS20LIQJ8wh0r6QrBf71w/dMxjbPNB8tiTKGUaFSz8/:qWk97S208twhW6oBh2mxjLn8tiTKGkM

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	2460	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2484	2460	705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2484	2460	705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2484	2460	705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2484	2460	705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\705585fe9c4b8771bd14bcf835c667f5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 192
  2⤵
  - Program crash
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...