e2b8d71c62b1f37b3ca541d7fdf653088be5a6b7a2c9668a291435736e6e20bf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe
Size

296KB
MD5

b45ace4af7f1e3cd1615851889a2e990
SHA1

16bb96c5ea8f6832dc2b1d8453364247f7b6dd1c
SHA256

e2b8d71c62b1f37b3ca541d7fdf653088be5a6b7a2c9668a291435736e6e20bf
SHA512

99a01de5eab296aa6f3c3d7f31f1e13a3ade2ff4215ec2d53f80795bfd69cc3d8b7c4f0039433f32085635984386d1d0b3d55eb09a369f4cea7c1573ac1194fb
SSDEEP

6144:tqSVGAkvzwvd1aoVa1rCLJmNR9PCLf7DNkVsuaRaU6mHG:HF1fmCLfF0aRz6mHG

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2384	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2524	2384	b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2524	2384	b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2524	2384	b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2524	2384	b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b45ace4af7f1e3cd1615851889a2e990_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 148
  2⤵
  - Program crash
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2384-1-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download