1810909d85658833400b01013e52d44aa69e2258114b6303a0a931181b72224b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe
Size

5.9MB
MD5

779ccc925e72453f91ac49048b44d29e
SHA1

ab4093e63bc85f296bc847d19f743825244f9fb6
SHA256

1810909d85658833400b01013e52d44aa69e2258114b6303a0a931181b72224b
SHA512

2e2426d3377afb25b4dac28e09cad4a478527006bbc7dde5e975c98bfb12b81c84dcfec0b00ef686ee2c2edc2d379f74503de2d513eb7f587618385ad6e5fb6b
SSDEEP

98304:vowl1cowl16owl1Fowl1wowl1vowl1xowl14owl1EBDtBDf13Fv13FPVWvz0yEXu:voVoDoooNoeo8o1o1BJBb111GbEXHMN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2244	2368	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2244	2368	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2244	2368	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2244	2368	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2244	2368	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2244	2368	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2244	2368	779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\779ccc925e72453f91ac49048b44d29e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$a$$.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a$$.bat

Filesize
55B

MD5
74ac44e9f04737f27beb24eba4075a30

SHA1
c19006d92870e63cca7156352cc4e575c18e54be

SHA256
bf4d4d5c5442673c858f3e19ba1dc20ef1904cea37acb26724425a69f89b7162

SHA512
ba06984134b8b754c3b3159adf828a468d5be1c6f7a55208e0e3b2657cf6ac1d880c0d86ff308981502acc4478859c04a16f1271ce2d5985fae3427199c450bc

Download Submit
memory/2368-7-0x0000000000400000-0x0000000000853000-memory.dmp

Filesize
4.3MB

Download