0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 17:05

Target

86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe
Size

184KB
MD5

86904bef92845b067a76d08ade4cc08b
SHA1

33ce7286d3a5f2cea3c5197e63fcbbc6effa026a
SHA256

0fe8469cbae130d45ae34e6c0a5c234928ad3776c4999ef03f065f960729408d
SHA512

7db74feff0246d8d5564cccbd23dcc555147881c7733f79c6013f9dcfae4f5f8d2fdde28722794665c73fdf85dd5f5d0a895fb9372dcc6fe0170b51cf1b293e2
SSDEEP

3072:r701YAYMLuPz7KhO0uZmmhi7hX0eZq5Y:s1FIL7j0cmE80eZ

Score

3^/10

discovery

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2844 1620 WerFault.exe 86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe

pid process

1620 86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe

pid	pid_target	process	target process
2844	1620	WerFault.exe	86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe

pid	process
1620	86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe

description	pid	process	target process
PID 1620 wrote to memory of 2844	1620	86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe	WerFault.exe
PID 1620 wrote to memory of 2844	1620	86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe	WerFault.exe
PID 1620 wrote to memory of 2844	1620	86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe	WerFault.exe
PID 1620 wrote to memory of 2844	1620	86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\86904bef92845b067a76d08ade4cc08b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 360
  2⤵
  - Program crash
  PID:2844

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1620-2-0x0000000003480000-0x00000000034C0000-memory.dmp

Filesize
256KB

Download
memory/1620-3-0x0000000003480000-0x00000000034C0000-memory.dmp

Filesize
256KB

Download
memory/1620-4-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/1620-5-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download