fdd93e4b5f1fe4e8982805829064fbc3c0f2c1ed19bf2ed2e19d8621f0297a57

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe
Size

7KB
MD5

c01c97ca84fd5ea319450b8eedd7388b
SHA1

44d0d6d05a040085d7515a371bf893e92e14ea71
SHA256

fdd93e4b5f1fe4e8982805829064fbc3c0f2c1ed19bf2ed2e19d8621f0297a57
SHA512

b4337e6dc1f6f833512704c14e1f10f480326db296ebe762d858acf81afc550a6bd88069b1ebe81544ae9bb36c4ec7de3fd49c6682da6223e0d8e118961a20c9
SSDEEP

96:Hz0nfK+oH2ehPbv6sFExRsqwto5g5uviTWvXah1v0YQ6EVbdEd+Yn:Hz0R2hmsF1qT25uKTQXQlQ6MdSBn

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	1460	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1044	1460	c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe	30
PID 1460 wrote to memory of 1044	1460	c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe	30
PID 1460 wrote to memory of 1044	1460	c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe	30
PID 1460 wrote to memory of 1044	1460	c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c01c97ca84fd5ea319450b8eedd7388b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 88
  2⤵
  - Program crash
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1460-1-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download