d90906eb9aa069339f02878134128c4f34b7f40a35d6ab9576290d81e824fa7f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe
Size

165KB
MD5

d2bc07ec07a33ea5105742fcfd90d8e7
SHA1

bba4372e19629f86b1f69e81987dd89036cb8982
SHA256

d90906eb9aa069339f02878134128c4f34b7f40a35d6ab9576290d81e824fa7f
SHA512

62339e9aa5409180b2235b40f3118cf9b76740670ec7760c2943b63671c5c7af7ce6bbe84d1730d85a4bedeffecef369c2abbe90230004e4e49355a3c2d4e10d
SSDEEP

3072:GuR8o6hDaAyQIrZBb2+fW3dFcsHihAK0kTz9P4Knl3:GuR8o6lpYIKQbJHipRpQKl3

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2404	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2352	2404	d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe	31
PID 2404 wrote to memory of 2352	2404	d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe	31
PID 2404 wrote to memory of 2352	2404	d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe	31
PID 2404 wrote to memory of 2352	2404	d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2bc07ec07a33ea5105742fcfd90d8e7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 116
  2⤵
  - Program crash
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2404-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download