a136cf7b57cccf599aefa1c1f85aca013fab8f0cce219acad75ec06fd531ec56

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 07:38

Target

aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe
Size

564KB
MD5

aa25b8366d2e772bc730f9e15a355826
SHA1

4f120c16c2a451526d15a9b271bd55f4fdb00313
SHA256

a136cf7b57cccf599aefa1c1f85aca013fab8f0cce219acad75ec06fd531ec56
SHA512

b0482f3cb32019f9ae82cfa51b9332d8986831ec949d2840c188453e8b93666a2da256a0c2233e88efead444b784385bea5af575c0a19570cd70af7f4c2ed103
SSDEEP

12288:J6VLh1b1/o5+oRmUGD4KpPAhaWxX6xTImsNf:JKb1QvQApxXlB

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe
1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1284	1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe	21
PID 1760 wrote to memory of 1284	1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe	21
PID 1760 wrote to memory of 1284	1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe	21
PID 1760 wrote to memory of 1284	1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe	21
PID 1760 wrote to memory of 1284	1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe	21
PID 1760 wrote to memory of 1284	1760	aa25b8366d2e772bc730f9e15a355826_JaffaCakes118.exe	21

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1284-4-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1284-10-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1760-0-0x0000000000400000-0x0000000000825000-memory.dmp

Filesize
4.1MB

Download
memory/1760-1-0x00000000024C0000-0x00000000025D0000-memory.dmp

Filesize
1.1MB

Download
memory/1760-2-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1760-22-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1760-25-0x0000000000400000-0x0000000000825000-memory.dmp

Filesize
4.1MB

Download
memory/1760-26-0x00000000024C0000-0x00000000025D0000-memory.dmp

Filesize
1.1MB

Download