6d26ca1e948f525b8612c250092413015a4b5a5082ba6f4b3177bc24f7412692

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 22:41

Target

950954017680cea71c42370f3b32d322_JaffaCakes118.exe
Size

456KB
MD5

950954017680cea71c42370f3b32d322
SHA1

f7c96cf7aa1f907aa8822e04e5ab249be124aee2
SHA256

6d26ca1e948f525b8612c250092413015a4b5a5082ba6f4b3177bc24f7412692
SHA512

47cc0aba7a52746cac1dec9c3a2426b823b3f2d59145b751cd1d5c23854b8bd24a5e97eaa4c79481e94b1dcb86e51263703326dc8e161a5ab13b6a399c441ebe
SSDEEP

6144:AV3E1jmpqY8yjLqMrmUw6lI5X44Dp8gyeiijMaaUjWFskKrDOsSpbsHekdYG+gqb:AV3EspWaLJc6i6YlzvkKggew8vl

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	950954017680cea71c42370f3b32d322_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2080	1940	950954017680cea71c42370f3b32d322_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2080	1940	950954017680cea71c42370f3b32d322_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2080	1940	950954017680cea71c42370f3b32d322_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2080	1940	950954017680cea71c42370f3b32d322_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\950954017680cea71c42370f3b32d322_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\950954017680cea71c42370f3b32d322_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2080

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1940-1-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1940-4-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-7-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-5-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-9-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1940-10-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download