6c12cf39adeb30247f9e2ee0402a9b1c48c9a069380451c80867b508172ecc81

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe
Size

860KB
MD5

c13c5def7b3aed47979e1b796f153a6c
SHA1

56d611ec0258b15038ff43fab0823d0ed32e8452
SHA256

6c12cf39adeb30247f9e2ee0402a9b1c48c9a069380451c80867b508172ecc81
SHA512

5cec300ffeb2881ecd427515dc268b65f53f6bd8921a68a8634a4df6249508b08f8c55824d886f8d7277458401920416bd8a640acf7103e41710899a9b9bea07
SSDEEP

6144:NrJO4iYY4XZpE7P7emry+kp9I+69clHKvjbdyrAL26O+to1:XOlYY4X87DpCp9uprsrF

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	1460	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2404	1460	c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2404	1460	c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2404	1460	c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2404	1460	c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c13c5def7b3aed47979e1b796f153a6c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 88
  2⤵
  - Program crash
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads