eb1e7c33febf6799e87b0853b92df3870c3bb2ac748ba89f8916ea7e6859eba6

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 02:41

Target

38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe
Size

28KB
MD5

38110e5fc14dfa951533a886a189d8d7
SHA1

c2f8740d11761de62503a937b7f25f81f65c791e
SHA256

eb1e7c33febf6799e87b0853b92df3870c3bb2ac748ba89f8916ea7e6859eba6
SHA512

35177a4bcaa74190504a5326a234ac0fe8be14d8f81402b7a0e620ddb42f2782a32569a689326f0a044d48cf4edcdc4a77f9a3572a8b75f9d2ed703ce0fbb276
SSDEEP

768:PyMVIAm+Vu/yTkUsHe5kLkVEYNG7Mhuj03sta:agZVu/SsHeQAqMcTa

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3436	4680	38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe	56
PID 4680 wrote to memory of 3436	4680	38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe	56
PID 4680 wrote to memory of 3436	4680	38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe	56
PID 4680 wrote to memory of 3436	4680	38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe	56
PID 4680 wrote to memory of 3436	4680	38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe	56
PID 4680 wrote to memory of 3436	4680	38110e5fc14dfa951533a886a189d8d7_JaffaCakes118.exe	56

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3436-2-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3436-4-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/4680-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4680-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4680-9-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4680-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download