4919fc9810870f56e6b796dfb6696dd05b496cea66fd9d2821b93c62c0a826a9

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 10:13

Target

739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe
Size

50KB
MD5

739dd9d02954f39f43caf31d60e8f2c0
SHA1

9b60c61f32b3cd7d90f2f532fb13442559770573
SHA256

4919fc9810870f56e6b796dfb6696dd05b496cea66fd9d2821b93c62c0a826a9
SHA512

5e11fd37e38d4cf8e34d44a40073253c56e27373087c03f1d25b87c0558ee8d387e378e0058090412b40f382bd15ec7d97d19795f31da564492cef8df6704af2
SSDEEP

768:vUjKVjl9xw3x6nz7vj1wrCRDBKnkTWpm1JgFLIqtclsbqztRXIF54QWnXENC:vUKJ3zzj1w2zK1iet7tcCbqz/myXmC

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe
4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe
4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe
4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 3468	4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	739dd9d02954f39f43caf31d60e8f2c0_JaffaCakes118.exe	55

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3468-3-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3468-5-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/4368-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4368-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4368-10-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4368-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download