4208f09c9d60d4e21f91fc4dcff0e0a91e8b9d65a13336278b8a8e62fa39cad5

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe
Size

280KB
MD5

f4ad4da6057b2af81df11d1ed8602ddd
SHA1

9a0e991796f199aad4646b191531cadc877c25de
SHA256

4208f09c9d60d4e21f91fc4dcff0e0a91e8b9d65a13336278b8a8e62fa39cad5
SHA512

2ab979c0616bc79efbb3cd3b9c4e645776bc6c7faa473cef0d2991f8502194dcc4bbe562905f1909a25101952a5181fc504ac7a2c0f33ab2dce07969fec9c55d
SSDEEP

6144:NtLVWoRQH0KiGWdKek62nRyFdbZ+pMWWB8O3mHI3l8VJOPKHw:pWAA0K9dfyjd2MWbOV2VJ

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	2332	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2532	2332	f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2532	2332	f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2532	2332	f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2532	2332	f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4ad4da6057b2af81df11d1ed8602ddd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 208
  2⤵
  - Program crash
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2332-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download