581a699e49a2b0f963e0c96629eed2048ffee6a7480638531e05e9b324c1f9f8

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe
Size

62KB
MD5

ff2852b2292c9f1948e6b11101c4d8f4
SHA1

74f316a7c2ed4b61ad60483a57dfcc073ec4cbfd
SHA256

581a699e49a2b0f963e0c96629eed2048ffee6a7480638531e05e9b324c1f9f8
SHA512

2332e1ed4295e6fa64930f7518cb17ade2ec8ce21c6d2ad65567ddcc30335f297ebc0ee264c00ee482dcd2421ef572994eb21f7d6771da806af35c9df8acd692
SSDEEP

1536:k45UZdxH4vtml8qiIqxD+QDONpReUzSsL88:k45wdxYvbqgDjODDzSs

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2672-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2672-1-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
660	2672	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 660	2672	ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe	29
PID 2672 wrote to memory of 660	2672	ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe	29
PID 2672 wrote to memory of 660	2672	ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe	29
PID 2672 wrote to memory of 660	2672	ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff2852b2292c9f1948e6b11101c4d8f4_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 36
  2⤵
  - Program crash
  PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2672-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download