620253fc4ff1fd65b7051c7b7f8420499f002f29684c2250725c89043afec7c0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe
Size

79KB
MD5

fb0ac94fe01cd5a5e44761609f9f3f5b
SHA1

b9e197daa40839f318647671bc23fd7a4a748bde
SHA256

620253fc4ff1fd65b7051c7b7f8420499f002f29684c2250725c89043afec7c0
SHA512

d7393d8c4018363f0aa7267a996031e00a43e84cfd45feb74ae1cc63212b717b9cd1106fb70edaba05c22f25f0b1f0a563dde6bc352c040dfdf9a573fa019ca0
SSDEEP

1536:/gUU+PBOyIjS4LAzW/S/Y5ZFxwCX+JVEXRVMd709eLqX33:omP9MIGdviJVEhVMd7MtH3

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1940-1-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	1940	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2216	1940	fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2216	1940	fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2216	1940	fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2216	1940	fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb0ac94fe01cd5a5e44761609f9f3f5b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 100
  2⤵
  - Program crash
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download