de88ab6343e9b9d75e127c3f54814280c7584d501794087596c7cf1c12e66b84

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe
Size

283KB
MD5

42cbdd97fff40fcf0a252a9b06fd277e
SHA1

7367bcc11ce0d8eb2e761caf29be9ba446f771c2
SHA256

de88ab6343e9b9d75e127c3f54814280c7584d501794087596c7cf1c12e66b84
SHA512

d3bacd591f30818822e0df524357427b8adb6726c1497eb4a24bf4745cdd7cb9299e5deda56ea9a88616419015031ec66d186b7af09c6bcc40223bf5c09fda31
SSDEEP

6144:2hsG+CqZAMLCtVCJxjJu8+pWm80QvEHOu5xbkV:2hsG+vAkCzKj+f8ww

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2400	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 800 wrote to memory of 2400	800	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	28
PID 2400 wrote to memory of 2088	2400	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2088	2400	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2088	2400	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2088	2400	42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\42cbdd97fff40fcf0a252a9b06fd277e_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 128
    3⤵
    - Program crash
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2400-12-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-16-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-14-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download