9f66135d831d5ba4972ba5db9e0fd4515dfaecc92013a741679d6cddbe29ab25

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 08:05

Target

514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe
Size

226KB
MD5

514e2771207cd146d0aaacebf15f8cf6
SHA1

c67bc182541878077c0059b009611dbbec82f78c
SHA256

9f66135d831d5ba4972ba5db9e0fd4515dfaecc92013a741679d6cddbe29ab25
SHA512

5e3b83ed64ad6272a4522c6746bcebc61d51ee0fc8754b6b369471516d602f11a1e86361d75f61f6e3c872a3d09651247f9ecff6e8716be593b5e24a3945b3d0
SSDEEP

3072:yTPx22c5QpFrHu+5bZDvO927Kvj+/0vHUXcx65V95/h72mIx0x4qhEkvfpXMyVRb:yM2cm7rOY1yCL3Mx6T/FsEJnywPV

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe

pid process

2248 514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe

pid	process
2248	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe

description	pid	process	target process
PID 2248 wrote to memory of 2448	2248	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe
PID 2248 wrote to memory of 2448	2248	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe
PID 2248 wrote to memory of 2448	2248	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe
PID 2248 wrote to memory of 2448	2248	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe	514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\514e2771207cd146d0aaacebf15f8cf6_JaffaCakes118.exe"
  2⤵
  PID:2448

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2248-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download