288791e3a09851d0b6f9051fd8ba14c713088c15f61a2e8c4e130c7556860fbe

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 20:33

Target

d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe
Size

31KB
MD5

d2c88f476c7db14d99b9b97c271d1039
SHA1

4655cd8fc489fa7138008128ca6959fd7c63133a
SHA256

288791e3a09851d0b6f9051fd8ba14c713088c15f61a2e8c4e130c7556860fbe
SHA512

1160bb6dc909a933b53f18dad727feb2208864f1f919b422ef95aca620d442c47ffd991b4cd3c1b2d2a2971c25f1240cd311b794273de2d53b5ff9cd0f64e0ac
SSDEEP

768:Z+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfKX:kZ/nEkh8OTKN9

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1456	d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe
1456	d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1252	1456	d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe	20
PID 1456 wrote to memory of 1252	1456	d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe	20
PID 1456 wrote to memory of 1252	1456	d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe	20
PID 1456 wrote to memory of 1252	1456	d2c88f476c7db14d99b9b97c271d1039_JaffaCakes118.exe	20

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1252-2-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1252-5-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1456-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1456-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1456-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1456-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download