11f71273e6d5522c3551ab840e062442de9328ed2b2117b98ab3adb80f7cc822

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe
Size

3.2MB
MD5

f2632bd49f37cdf681b187438e4f6173
SHA1

13b11925bc8f7c0a3f76eca2d70fe06b44e3e245
SHA256

11f71273e6d5522c3551ab840e062442de9328ed2b2117b98ab3adb80f7cc822
SHA512

08b2d1b400fd625cd997b3046db49189563419ef4ae9c47bfb28ee9a622d51450bd01613f8f549a88fa7bf4229c476b1e18369fe2088956dc00de0ad530347ef
SSDEEP

49152:ghPg95YC1yRr5R+jzA66ymAu1Rg48D9d5VGoemcYVeGaY0uWV355FXw/+fuWV35j:EgXt1yRr8zA6POvwga

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	3008	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2156	3008	f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe	31
PID 3008 wrote to memory of 2156	3008	f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe	31
PID 3008 wrote to memory of 2156	3008	f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe	31
PID 3008 wrote to memory of 2156	3008	f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2632bd49f37cdf681b187438e4f6173_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 188
  2⤵
  - Program crash
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3008-1-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download