fbd72924b6a6d5d8fbf2e285082c01234c1e4c376cd653a8e168f65f39e11221

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe
Size

83KB
MD5

10645df00efccbb58cfb48d38d8c3ce8
SHA1

70fdb3fa56d5d9aba70e52a9984f1cae1260245c
SHA256

fbd72924b6a6d5d8fbf2e285082c01234c1e4c376cd653a8e168f65f39e11221
SHA512

96e11784c79f25c747e37fb49242a35ecb0a8ee8435d080cd01854c5a2347913cb03331e50143b93d8361f234b3cab4f2f560129994cd07dc4232e7a9acc3153
SSDEEP

1536:S800hhPyECSfatTtP+xq3mnaZ1NJhkXAxfqr9D+:S800hhPyECSqefS1NJhkX5hy

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2388 set thread context of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	5012	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87
PID 2388 wrote to memory of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87
PID 2388 wrote to memory of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87
PID 2388 wrote to memory of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87
PID 2388 wrote to memory of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87
PID 2388 wrote to memory of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87
PID 2388 wrote to memory of 5012	2388	10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\10645df00efccbb58cfb48d38d8c3ce8_JaffaCakes118.exe
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 12
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5012 -ip 5012
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download