2f7a16718ffadc91e500083fb561ebfab4be564a0a2c95d39e4ff855ab1ec857

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 05:47

Target

f55308148f6a97de01e1c9051d240107_JaffaCakes118.exe
Size

160KB
MD5

f55308148f6a97de01e1c9051d240107
SHA1

c94b5eb7382c8bd5ea3da8b8444e5ada54f037ff
SHA256

2f7a16718ffadc91e500083fb561ebfab4be564a0a2c95d39e4ff855ab1ec857
SHA512

1240b8e1cba4a1cc63c00ca8ad616f718435c2d084531b10039619d0cb485dd81a803f6e6e1031a838127bd7bbd4861c86aea8c3b1fd121d686158a6e2105700
SSDEEP

3072:gEs8EnlbjiNVj7ez89OX/3M3I2jQQ3L9kdef95vyG1dAhMHB:g58EnlCVj7eA98AjnIefbvlm+

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f55308148f6a97de01e1c9051d240107_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3424	2748	f55308148f6a97de01e1c9051d240107_JaffaCakes118.exe	56
PID 2748 wrote to memory of 3424	2748	f55308148f6a97de01e1c9051d240107_JaffaCakes118.exe	56
PID 2748 wrote to memory of 3424	2748	f55308148f6a97de01e1c9051d240107_JaffaCakes118.exe	56
PID 2748 wrote to memory of 3424	2748	f55308148f6a97de01e1c9051d240107_JaffaCakes118.exe	56

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2748-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2748-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2748-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2748-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2748-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2748-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3424-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3424-8-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download