71b893c3114cf33324998bbc2a7921feb75a78ff23c95966cb55b92a0f144b4e

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe
Size

173KB
MD5

dc2df23d6d7eb88bc9c262228f8391ba
SHA1

41feac1a05b090ade52db12b885570be4f5f0e78
SHA256

71b893c3114cf33324998bbc2a7921feb75a78ff23c95966cb55b92a0f144b4e
SHA512

30a9c015960595b4f66d69fdc4d04f778a7ed536cc29ddb6b797a0dafa1d7baf33fd72b4e205957b04365eb7dc2cb590df685b91611acde17a73f170749cff9c
SSDEEP

3072:BEEGA3tiI4Jay87me/Y4uy5pMeSlY9pjrR:XGA3tMameiy52e2Yzj

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	1924	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2132	1924	dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2132	1924	dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2132	1924	dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2132	1924	dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc2df23d6d7eb88bc9c262228f8391ba_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 136
  2⤵
  - Program crash
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download