206643a7cd1a4cba93e671c8ea98e016088c24187e9d280b9140e03545c96837

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe
Size

38KB
MD5

d1eb5477c663a9ca57ab4924f38b2946
SHA1

54b0e434a32d08a3aacb5d7d0d7b9bc45079ab24
SHA256

206643a7cd1a4cba93e671c8ea98e016088c24187e9d280b9140e03545c96837
SHA512

cdbab9c4aa7be78f5c79969d4972046aca995232c4903f1d7d55f24313ac3d70a32afbee75c4e9209fd1062487b877242ca8e9ef0714bcf8bafba3f877a5c910
SSDEEP

768:40KpCxFGM1Q2snZzd2p8o+AFu+Zdf7za0oMBBIjRp6LysTI78aN:4Zy3F9f/a0PBIj6LyJQY

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 3052	3032	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3052	3032	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3052	3032	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3052	3032	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3052	3032	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3052	3032	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3052	3032	d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d1eb5477c663a9ca57ab4924f38b2946_JaffaCakes118.exe
  2⤵
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3032-10-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3032-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3032-8-0x0000000013140000-0x0000000013150000-memory.dmp

Filesize
64KB

Download
memory/3052-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3052-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-4-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download