181c228f26a91cf86be3f5ba6a447bcb72d8949cb0deb58f30957ef4992f82b5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 23:30

Target

b146f450483b6d181c069c96c780335b_JaffaCakes118.exe
Size

31KB
MD5

b146f450483b6d181c069c96c780335b
SHA1

b718594bda90d36a34c4fcd41d99c8a3908efa2f
SHA256

181c228f26a91cf86be3f5ba6a447bcb72d8949cb0deb58f30957ef4992f82b5
SHA512

ef67e77733162344c5d5febed9e9fce13fd05fc20473ab8728a2caff4997f9af51bf9bc5e7b31867d9d7fe4c2827ffdd3fe418ae426b6e80f1957171041cc2ed
SSDEEP

768:zIPfXOhlKoLxtCt74y/842kGim5admgS0CX0McB:4CKoLD+h/84UimkdxM8

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b146f450483b6d181c069c96c780335b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 3424	468	b146f450483b6d181c069c96c780335b_JaffaCakes118.exe	56
PID 468 wrote to memory of 3424	468	b146f450483b6d181c069c96c780335b_JaffaCakes118.exe	56
PID 468 wrote to memory of 3424	468	b146f450483b6d181c069c96c780335b_JaffaCakes118.exe	56
PID 468 wrote to memory of 3424	468	b146f450483b6d181c069c96c780335b_JaffaCakes118.exe	56

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/468-0-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/468-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/468-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/468-7-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3424-2-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3424-3-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download