9e1c66c602e79376310d973fcbb57439f841d93e0e4e4f9a178de42cb770bff4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe
Size

477KB
MD5

130b83c51e16b98afa9a2a774d078ff7
SHA1

43aed131c4e9924df341f4d08578f75a696392ee
SHA256

9e1c66c602e79376310d973fcbb57439f841d93e0e4e4f9a178de42cb770bff4
SHA512

c9273a7798a2e7cb2983dbfe4015a51c0f875e74aa2442c6c90f2bb97e10533280420af14a88399e553d5b3a9b7a0eb1c9acd2dbee65a4f45966d69afb7e01c6
SSDEEP

12288:slmhLR6QXTFDw6RMJ3sVgFtieiXbdFO6nFmB/J8AFloj6:sk7O6qcV4YvO6I/8Oloj6

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	2676	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2732	2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2732	2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2732	2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2732	2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2732	2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2732	2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2732	2676	130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\130b83c51e16b98afa9a2a774d078ff7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 352
  2⤵
  - Program crash
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLC1870.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit
memory/2676-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2676-2-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/2676-1-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/2676-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download