0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe
Size

188KB
MD5

868425eaf099f8e6da6c700c78f6acec
SHA1

eed2ff4dc3ae73d50cf9335db270a7a0b32c54f7
SHA256

0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412
SHA512

f2676ceb3a29e818fee48c9ed71ebf928c1750f1f3908346cf39c7e80b76647d8223d429997e46a2a156fe177727b88dbec51c67bf6244b3c01ed5a8341d9b9a
SSDEEP

3072:P2D3fEQp14waCJL1NWX+ptiyjzl7OqZMuDKz/z/oT2qyIAkknsDsSG3bI:P2D3F4wN1a+3h7/ZHEjoT21kLIr

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	2848	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2740	2848	JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe	30
PID 2848 wrote to memory of 2740	2848	JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe	30
PID 2848 wrote to memory of 2740	2848	JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe	30
PID 2848 wrote to memory of 2740	2848	JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0f72e98871067ce5eff371573726301640226778e15609c58dad6745ddca1412.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 36
  2⤵
  - Program crash
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads