438ee37987c44959ee2e9e7a514ef1c5ed584dd5ed5a029d55b1acc2e53380ba

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe
Size

122KB
MD5

df42ac469fab4205e7f9ab76a6580bcd
SHA1

dcbfe8c2d9c899776dedc354609ee5a9def84547
SHA256

438ee37987c44959ee2e9e7a514ef1c5ed584dd5ed5a029d55b1acc2e53380ba
SHA512

0de68a3414f983079724ef9bf8c3f5933b0b344fc0522fae830d4683e90a1acd66c52b40a3c6daebda2548b3866d45d67e4e8c2452ad047c4dcd89b25a175cbe
SSDEEP

3072:1MD4khjal6KYCT20il1u+4vlAu/WZXtTUzDH09S2C4ku:e4khjtKYCdils+4dAd6YgT4ku

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	1724	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1816	1724	df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe	30
PID 1724 wrote to memory of 1816	1724	df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe	30
PID 1724 wrote to memory of 1816	1724	df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe	30
PID 1724 wrote to memory of 1816	1724	df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df42ac469fab4205e7f9ab76a6580bcd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 36
  2⤵
  - Program crash
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1724-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download