231a02929d7c30243eb0462c0d90a012da7da7223f65196a5afd864edb62766a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe
Size

429KB
MD5

12a9d5cf35845b878d5c62bc1659d3b2
SHA1

83de36a77ba7079b7e4bdc94214affcd345b5523
SHA256

231a02929d7c30243eb0462c0d90a012da7da7223f65196a5afd864edb62766a
SHA512

c9802559ab15beddb6c7040270c6e0cf4287006743dd5d65f11d683da4f19ee9430acf7e99f62eb19506b4d121b91e1fb6486cef6ac390016f460fef8ad1fdbf
SSDEEP

6144:kDgdJBcIDWAu6+NkZ62j+AyD8pT/2G2zXFbkVUsbE6NHeHZkIFOjOBcgqqryaZw:fu2KAyD8pT/2G2zXFbkVUsbE6NHkwgXq

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	2232	WerFault.exe	27

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2520	2232	12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2520	2232	12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2520	2232	12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2520	2232	12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12a9d5cf35845b878d5c62bc1659d3b2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 284
  2⤵
  - Program crash
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2232-3-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download