021aa7fb054b5f42c09df5d49e4c50251942749e5c35cbcd9afdd582d2c2cab6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/12/2024, 23:26 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe
Size

153KB
MD5

e8c670494a31aec67e696d78ceeb1316
SHA1

355dc433cdff0b7a2b61df0a8c421e2c0916ff41
SHA256

021aa7fb054b5f42c09df5d49e4c50251942749e5c35cbcd9afdd582d2c2cab6
SHA512

e1cae62f68ab042a8f2c4dccb10977827d315b5731649f688e0f7965aa56f2da161881130151689e80362e6459add7c710fa6ca98401dcf183c6e4e96da6fadb
SSDEEP

3072:723TS7hzP4bTr8VYezOMVlSF36g42eiPU131RbVoEhqdETCqCh0L:723TSJAbsVzVkFKgJs1/GEodpM

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1780	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2172	1780	e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe	31
PID 1780 wrote to memory of 2172	1780	e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe	31
PID 1780 wrote to memory of 2172	1780	e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe	31
PID 1780 wrote to memory of 2172	1780	e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8c670494a31aec67e696d78ceeb1316_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 120
  2⤵
  - Program crash
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1780-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download