593cff3f581521130c278f9cea06d171a7123f818750a01aa1823d2fd6954b99

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 06:08

Target

3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe
Size

28KB
MD5

3e381a6a29ba0fddd97c873f96928d61
SHA1

9d759988100e52fc5259efa0308b924b15d43657
SHA256

593cff3f581521130c278f9cea06d171a7123f818750a01aa1823d2fd6954b99
SHA512

861c19ad9c9b36450443b34f48b847ed9c75c6a933e7e05c3f4824e3497a7d7120f96f0664af29c4a16e294e474a5d47b1d3edf4eb6f8358d9267dc92a5d5575
SSDEEP

384:UmOyMLjKMPH1Dxw7ZA8l9ZoA7k+w9G5hmssR0IkR46nzojn8mgRRtssIeo/r5J14:hUjKVjl9xw3x6nz7vj1wrK

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe
2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe
2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe
2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3460	2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	56
PID 2896 wrote to memory of 3460	2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	56
PID 2896 wrote to memory of 3460	2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	56
PID 2896 wrote to memory of 3460	2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	56
PID 2896 wrote to memory of 3460	2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	56
PID 2896 wrote to memory of 3460	2896	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	56

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2896-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2896-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2896-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2896-9-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3460-2-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3460-4-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download