1b30e21d075c4911fc18525bf94b5962f16eb46378d88a42d612b3616f87b116

Analysis

max time kernel
90s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 07:03

Target

f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe
Size

313KB
MD5

f9f39b025dda86b1046182c5b9a81df0
SHA1

fa4797b13838a27d05693b13e49306ab2c9e9cb7
SHA256

1b30e21d075c4911fc18525bf94b5962f16eb46378d88a42d612b3616f87b116
SHA512

fd91fdc196fbd1faea7bc4f222785eb8c59751287fc44ab75591719534ac5872369aec946176e20548bfbde2a35b39c7b5c0148d09af9cbed1947facc607ec15
SSDEEP

6144:gnCsW0ZzzLLayYKVsKVNtsDQib08wARt+X4c+ofVu7hRm:O80RHLpzh+DQiZwi+V+2s7hRm

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe
3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe
3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe
3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 3464	3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe	56
PID 3744 wrote to memory of 3464	3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe	56
PID 3744 wrote to memory of 3464	3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe	56
PID 3744 wrote to memory of 3464	3744	f9f39b025dda86b1046182c5b9a81df0_JaffaCakes118.exe	56

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3464-4-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3464-5-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3744-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3744-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3744-2-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3744-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3744-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download