9894d7e16971c8f7b9eba51489a1978079ecb7873b69e3b800de0f3d7d000123

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe
Size

96KB
MD5

dd6e1d1a86e534d3c6e6b65a8c5bb37e
SHA1

964aeb748088e255e43d3edf1645354f2036e542
SHA256

9894d7e16971c8f7b9eba51489a1978079ecb7873b69e3b800de0f3d7d000123
SHA512

0923abe7d71f04df7e33a4b4fbc91871550163f6090ae439dd1d5b72b9ab2d0791710f2c439441ab26373e95136e8b8f05d849f286cdca3055c90018062d2257
SSDEEP

1536:YXKmyBTmOc8tYxGLUgOZmzq4EE76jXkF25kSuKkzyoVFruHhKiEJ:8y3c8tPxAXkFqyyCFruHh1EJ

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	1672	WerFault.exe	27

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2124	1672	dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe	28
PID 1672 wrote to memory of 2124	1672	dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe	28
PID 1672 wrote to memory of 2124	1672	dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe	28
PID 1672 wrote to memory of 2124	1672	dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd6e1d1a86e534d3c6e6b65a8c5bb37e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 120
  2⤵
  - Program crash
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-0-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download
memory/1672-1-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download