598a6b538b88142e0233befa1a15560db3cb5082baa9639b086c6017c21ce2f2

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe
Size

319KB
MD5

eeed8da62dc83ab124c799c37cf8bd5c
SHA1

814509fbd2df8f55efc72c9ed6ab9ee2b5766866
SHA256

598a6b538b88142e0233befa1a15560db3cb5082baa9639b086c6017c21ce2f2
SHA512

48b8c3dda2212d9bfb52ada2f578733876bee66961b9e6d01e9dc3ef45dff728e7f05816f13e508cdcf4d47fb623daee23016f6e64a8abc78e90ac772660c345
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl/:OFOoKnsub6oHprG5+3a7STY/

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	488	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 1124	488	eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe	29
PID 488 wrote to memory of 1124	488	eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe	29
PID 488 wrote to memory of 1124	488	eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe	29
PID 488 wrote to memory of 1124	488	eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eeed8da62dc83ab124c799c37cf8bd5c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 116
  2⤵
  - Program crash
  PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-0-0x0000000000F40000-0x0000000000F95000-memory.dmp

Filesize
340KB

Download