e7620a4f297f4032d70afd02f4b0348e76b84b66c0a6dbc690ac43bf74993817

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe
Size

105KB
MD5

81c553c23dd7a0f035b50cf98f001885
SHA1

18145f23507f80d7ed7d6937a23d8debf07f7600
SHA256

e7620a4f297f4032d70afd02f4b0348e76b84b66c0a6dbc690ac43bf74993817
SHA512

4f01fd7b2cd04d8936c800e0599e6ec76761d612edd7940c273934fa62a2fdff78c20b4e3ac262a763ce2db0a5ff164853192fae3c2a00e934ba4b4d0b207bb0
SSDEEP

1536:f9YRPsSChbbjRHA5Vo1lV8ZuO4ZlZSxWosmouOXDcX0qoF9sbgvWZV8RRYj/4:fMESCQ5Vi/hO4nUxWLmotXwXmru8Tu4

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	3008	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2840	3008	81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2840	3008	81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2840	3008	81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2840	3008	81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c553c23dd7a0f035b50cf98f001885_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 36
  2⤵
  - Program crash
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download