e6e5eb92be39512891b242646b6c0dd5043a2d8b8095fb86f27a80ab9c4b2ab3

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 00:22

Target

f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe
Size

56KB
MD5

f7273f12b5c8b90d33abc3fd984ecb30
SHA1

05f30b626f86d094bec9f37298678caf937b4459
SHA256

e6e5eb92be39512891b242646b6c0dd5043a2d8b8095fb86f27a80ab9c4b2ab3
SHA512

b13310e6acf3834030202a9038476f888b2d18f02501a19cf3999d28c107062ed6af4fcb25f876553d71fe9815ae1c3ecad614b829cfcf6c374acc85c94c8a7e
SSDEEP

768:FcevFIYm0on6HGavZRtQffoaFNnioeQpYGvIkRDz4ua/k/Uz3nvnUIh+Dt6FBATY:ncV6HGavqgavRDsuQwqfU6BFchfUWIv

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe
60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe
60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe
60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 3424	60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe	56
PID 60 wrote to memory of 3424	60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe	56
PID 60 wrote to memory of 3424	60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe	56
PID 60 wrote to memory of 3424	60	f7273f12b5c8b90d33abc3fd984ecb30_JaffaCakes118.exe	56

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/60-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/60-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/60-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/60-7-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3424-2-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3424-3-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download