Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe
-
Size
134KB
-
MD5
07f9f4658a37c9298b56d21e8da9abdf
-
SHA1
ea672fc11761f55a922fbeb0025a4d74f382a765
-
SHA256
acc4527dc20808ac93e2e5f1e38c5696f9b016d0f78d7f05ce26f3411ee56d4e
-
SHA512
6347c2701f70892fe5936da4a5bd8209e542d8f451a8e7b476b8bcac8f324cbccf1e17875249cc210a2377c976e23a86daa943ef2740d2d5836e36edf08a5592
-
SSDEEP
3072:QLkFFr7GN9xvXYpZGNL8SAi6X0h/ghfr50JhOUvwrhUN9PW/t:iW5G35UZGNIBEhIhzeDA
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1836-5-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/1836-6-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/1836-2-0x0000000010000000-0x000000001000F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1836 07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1836 1600 07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe 30 PID 1600 wrote to memory of 1836 1600 07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe 30 PID 1600 wrote to memory of 1836 1600 07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe 30 PID 1600 wrote to memory of 1836 1600 07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\07f9f4658a37c9298b56d21e8da9abdf_JaffaCakes118.exe?2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1836
-