b0bf37879882a5d6a8733ca07a0c07d8558669ced3ecc5e73931a57edc2279da

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe
Size

90KB
MD5

031c5c6a752eadd05f7fe792c3f97cf8
SHA1

d988102bc1295025fe8a857479b24c2ad48414a0
SHA256

b0bf37879882a5d6a8733ca07a0c07d8558669ced3ecc5e73931a57edc2279da
SHA512

a75e763af5e573b851157020920396739934ec2d1e6a09c1dac557d23fc68f858add62d1176f38adafffa4ca1f8dc2158897cbbbdb8c8b0c4147529242ccc4c9
SSDEEP

1536:uQGt3T12JFvCX43tWJuzTnYBlTPlojXA53Sw8DIyC7XZmeppohr9hTcO:Bm3XpJuwdojAZSRJFhr9hoO

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2584	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2528	2584	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2528	2584	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2528	2584	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2528	2584	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2528	2584	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2528	2584	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2528	2584	031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\031c5c6a752eadd05f7fe792c3f97cf8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 272
  2⤵
  - Program crash
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-1-0x0000000000BC0000-0x0000000000BE4000-memory.dmp

Filesize
144KB

Download
memory/2584-2-0x00000000000F0000-0x0000000000114000-memory.dmp

Filesize
144KB

Download
memory/2584-3-0x00000000000F0000-0x0000000000114000-memory.dmp

Filesize
144KB

Download
memory/2584-4-0x0000000000BC0000-0x0000000000BE4000-memory.dmp

Filesize
144KB

Download
memory/2584-5-0x00000000000F0000-0x0000000000114000-memory.dmp

Filesize
144KB

Download