352a12e55c6a4b5118142bdfe229a0f36a2c469b5548926fdd498713ff435399

Analysis

max time kernel
140s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe
Size

32KB
MD5

ba031c4a967e5f56673182aea9e5226a
SHA1

de790e3764f36a7606ad57b57b3c12e68f7c6237
SHA256

352a12e55c6a4b5118142bdfe229a0f36a2c469b5548926fdd498713ff435399
SHA512

2e1d715468cdaf5311418ff15a7fa84859229c566502b72021d05b178c7a70eaec01f3656da828d17a22ca20bd8c19a69b7009ab21cb8931412cbbb0fd396f17
SSDEEP

768:r+1U+7MRdGYxbq5V+fL1ICbZPmnbcuyD7U7:rceRdyVgL1ICNPmnouy8

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	2448	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2444	2448	ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2444	2448	ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2444	2448	ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2444	2448	ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba031c4a967e5f56673182aea9e5226a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 44
  2⤵
  - Program crash
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2448-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download