bdc6ea59587c76516847690520f670b387b74439d5248309e4d199fbe9c7b621

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe
Size

284KB
MD5

01d5279e890ee63e6d3fb6d4e155beeb
SHA1

5c2d600366204bd0b01d666b9cdb40d69f04cf9b
SHA256

bdc6ea59587c76516847690520f670b387b74439d5248309e4d199fbe9c7b621
SHA512

1f626439f700bdff1b9f1281512697e886ecb89ab53d644761d75ae7b48d3f870fbd11f7f507c04fcb3bcc6eab3d8f057a4f341050ccbf2fe7ac5a7837a302af
SSDEEP

6144:pY7AUBIvrSO00vn68rAdN91ZNi1h+m0SeGe:pY730r08psdtZwamte

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31
PID 2404 wrote to memory of 1932	2404	01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\01d5279e890ee63e6d3fb6d4e155beeb_JaffaCakes118.exe"
  2⤵
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1932-12-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1932-14-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1932-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1932-8-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1932-5-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1932-4-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1932-2-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download