2a41fe30aed8ef823bb2c510bb6c39e75b178834aa30c5bc183e1a0584bd7911

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe
Size

431KB
MD5

e04885aa2e1bad8257f85da9e94255ef
SHA1

ab9bd90d7a3dfe714f0bfacf942e033696361e88
SHA256

2a41fe30aed8ef823bb2c510bb6c39e75b178834aa30c5bc183e1a0584bd7911
SHA512

672b70a8e9220d52cc9a212cfdcc816f938dfb4b22956daf6a7f619b30ed394c79626ef89e13c4320cfc0090de6414d47ce3ffe8d5ceb7ec40509624de853d2d
SSDEEP

6144:AHjbISX2Tlh27NQVyP7mCGds2Vwu//MTxP0WwCd+6UPaPyxD5YBGaTRTvlIsdZ2I:gISX25mmyP7gEwk+6um9RTNCsIuR

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	2664	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2240	2664	e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe	30
PID 2664 wrote to memory of 2240	2664	e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe	30
PID 2664 wrote to memory of 2240	2664	e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe	30
PID 2664 wrote to memory of 2240	2664	e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e04885aa2e1bad8257f85da9e94255ef_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 252
  2⤵
  - Program crash
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2664-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download