5b41c6c67f4a0ddc7a519b87ffe7b3b5bf003ed39c237fa0252d33d23ccbcb3c

Analysis

max time kernel
11s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe
Size

71KB
MD5

b32a2d39c701b93267fa980c914b7037
SHA1

aad3568f0e371a68a5b978760c66769bdbcb050e
SHA256

5b41c6c67f4a0ddc7a519b87ffe7b3b5bf003ed39c237fa0252d33d23ccbcb3c
SHA512

ebc045a14846f4f031914d10a4f873532743c223c94c5e929009a38cf3990b311b81cc92b8c7105ba475fb5e0e6c4d5653c8409ca0af61a98c69a07b259e9bce
SSDEEP

1536:kwOnbNQKLjWDyy1o5I0iJUEbooPRrKKRXyyGKNZ:WNQKPWDyDI0iJltZrpRXyy

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2548	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2504	2548	b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2504	2548	b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2504	2548	b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2504	2548	b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b32a2d39c701b93267fa980c914b7037_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 160
  2⤵
  - Program crash
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000001000000-0x0000000001019000-memory.dmp

Filesize
100KB

Download
memory/2548-1-0x0000000001000000-0x0000000001019000-memory.dmp

Filesize
100KB

Download