46c61bd83388f51d8dbdd2e173761d929f9c49bec51cad2f4611b1769bab121a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe
Size

7KB
MD5

8b7265c5ac52fef6992b052e5fd449a5
SHA1

6a91c9872a9bbb98666c4fde8f5f5902dca0216c
SHA256

46c61bd83388f51d8dbdd2e173761d929f9c49bec51cad2f4611b1769bab121a
SHA512

4463d88baa18b4205f9f21973adb3f295d1dc47eed779fb948942928047130a5dd905e5552066f36d5ae6ae0117b72eec9ac4bf6a9d7a410a5563861b69331d4
SSDEEP

96:4eT4X5YewtEYMA4v0AneXEVDGEJmCwb++eiQL2nEXnUpFZ:VcXW9iY/+e0VpJPyptEUp3

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	1152	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2660	1152	8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2660	1152	8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2660	1152	8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe	30
PID 1152 wrote to memory of 2660	1152	8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8b7265c5ac52fef6992b052e5fd449a5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 396
  2⤵
  - Program crash
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads