1da295b1f8c39d86f260c87a172abc5e52185d62076dc2b56922d81067d78769

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe
Size

67KB
MD5

a3315aa0b0ccbff862abc8881624e923
SHA1

eb6474a17109e7a5753ee863458ec50f9badc5dd
SHA256

1da295b1f8c39d86f260c87a172abc5e52185d62076dc2b56922d81067d78769
SHA512

c049fa9969f1621235e9977b93e3c7ed3709db76dc81518fbda6c876b473996a5739b2b61fcc30efcd5b5afd0c7a594b1a5447ac4102fa4f9ac97a4e7f4a5170
SSDEEP

1536:UwpW9UaDLSvuQUE6UdYwiSSgOkflWWGqX:dW9UaDuvlwU2KSgrcWGqX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 1820	400	a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe	29
PID 400 wrote to memory of 1820	400	a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe	29
PID 400 wrote to memory of 1820	400	a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe	29
PID 400 wrote to memory of 1820	400	a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt61817.bat "C:\Users\Admin\AppData\Local\Temp\a3315aa0b0ccbff862abc8881624e923_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bt61817.bat

Filesize
6KB

MD5
358ed8a26a44b8e375cb2ba8a735c6d8

SHA1
16d08d963c5bb4c61500c6e80f3d946f034c559e

SHA256
bb9da9fbce2d447b56c055579e8aadc854ad4c3b472f3f70a165a1d3495c6058

SHA512
b10a10d1c1e7cc709bcdbb373c5a2398385697f0dcfeb06d665dd3caf175e9156df09dbabbd7074b502b2fd95675665487530825a40b4c3386f4ae2c779caf23

Download Submit
memory/400-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download