e9c27ff3571ffffae61e5d3ff656012852c6665f5b03460c725545fa0ec399cc

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe
Size

213KB
MD5

07a4be1b3cd83c4d93c03f8c4d94e749
SHA1

9f93eef1d76dc7fb81c1a27072fcdaba13ceecaa
SHA256

e9c27ff3571ffffae61e5d3ff656012852c6665f5b03460c725545fa0ec399cc
SHA512

8b6869d4d4e287f9694fa216d221c58b4c2cfcd9a95d26a3dc7f8f4abb57bf37b51909f25256a2956965c381a86911909a6c31c81112560009b25050cb7edee8
SSDEEP

3072:jj+5uXupwuv9QpxmqqnsZdysdJzTFyBfaFoNpOjYWQ6i0UX/poXP2Venq5+:j9Sv9QpintsdHef0YWnizX/poOU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1016	2236	WerFault.exe	27

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1016	2236	07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1016	2236	07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1016	2236	07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1016	2236	07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07a4be1b3cd83c4d93c03f8c4d94e749_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 164
  2⤵
  - Program crash
  PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2236-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download