9a0d0ae3f7cadcc27dc8e18bacdf0324aa7487d6b88396e182187cd7b07e4dd8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe
Size

776KB
MD5

fd081dd8686371a1e6cee1b7f4527aca
SHA1

869e0db2a7f48809d308ffd0d21f5278a00d1798
SHA256

9a0d0ae3f7cadcc27dc8e18bacdf0324aa7487d6b88396e182187cd7b07e4dd8
SHA512

baf5991b0db6ab2eb546fe4171fd2fa714cf5c715c53e4afb2c7c7807c630cfa8042b327c721ddf6119492cdad66da69afd9931051b9beb0bfb2eb7dae9e65d4
SSDEEP

12288:iLxu3eG/be56t0DB9N3ljUyksLl4CmONtQK1PffjihknezdcX4wfTeiRxsrDaG:iduuoedVoyksLl4nONt/9fjtic/Rx4eG

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2936	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2088	2936	fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2088	2936	fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2088	2936	fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2088	2936	fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd081dd8686371a1e6cee1b7f4527aca_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 36
  2⤵
  - Program crash
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/2936-1-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download