ab5f34b5931b6544be86f9f09b7d4028e4089a0a9d743f74c20005e55ae5eacc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe
Size

187KB
MD5

81c9d1eff622aafdbef5f1e4eb0115c4
SHA1

8e71bd0982c9d4755ed25948b2788a5e8ed0bd7e
SHA256

ab5f34b5931b6544be86f9f09b7d4028e4089a0a9d743f74c20005e55ae5eacc
SHA512

8d030ba9cb034a1842808e50d2497eb85aed454c03c288faa69160e4db87bde4fd0de7f7d35f5a2659139ee45e8de12eda8647b89097724370b5173585dc4803
SSDEEP

3072:2AxYc7UHy7h2cOdC5+lrZH8CRpIm2XYdSqJ2gRXX7UAe1vKQfZR9sVSKCXM55EHP:27sYyV2ce7JZcCnE2SqJ2CXXwtJjNSSp

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2500	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1696	2500	81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe	31
PID 2500 wrote to memory of 1696	2500	81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe	31
PID 2500 wrote to memory of 1696	2500	81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe	31
PID 2500 wrote to memory of 1696	2500	81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c9d1eff622aafdbef5f1e4eb0115c4_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 164
  2⤵
  - Program crash
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2500-0-0x00000000000D0000-0x00000000000D8000-memory.dmp

Filesize
32KB

Download