Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe
-
Size
182KB
-
MD5
eac0c387be506fce50a42f60bea01b15
-
SHA1
2a1b8f8085ec2067cd57349c3b8e4fad1d4ed1b0
-
SHA256
e0fe7e58b07ee4a4372fe0bfe2829a661585dc453f690e844173d8693758d1f1
-
SHA512
938b927a09f56ef1b4d1b870e71a9b3503186f2c50e0452eb70394441efb49b2fe27872c852b53fd7325544655922b556221baec407610373e700d5027c82750
-
SSDEEP
3072:P+P+qZ2vTRHJcPwPOiIskJfbhp7M38huQG7phYhizPM5tBvTjM5EaJUBXBWoGwOZ:P+P+qZkT8wPOiIskJfbhp7M38huQG7pD
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21 PID 620 wrote to memory of 1204 620 eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eac0c387be506fce50a42f60bea01b15_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:620
-