9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe
Size

188KB
MD5

66512dc06b72c47e131027fa8f930d29
SHA1

f6f4bab25628549a817fb7c69e7e58c2a6b4e24b
SHA256

9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4
SHA512

c16c461b3edf2773a5cc72644373d26b6fd27e7d395a8218d9ff821ddc85fbe7f24e71eae8276fa3a7a9fe8ee516b2caceac286d98c1bafbd23fde9cd8cfa3ae
SSDEEP

3072:rX/uHiIgZoQXzHc9heuYtWJtiBl/Qmh4dcBJa8gNQYtARuK6wbSNkSqG8KwE:7/jFhzHseuYUCIg5/a8g2xbyoir

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	2344	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2608	2344	JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe	29
PID 2344 wrote to memory of 2608	2344	JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe	29
PID 2344 wrote to memory of 2608	2344	JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe	29
PID 2344 wrote to memory of 2608	2344	JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe	29

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9059c4810bce97a830fcf0c57bfc929d38e01017ae7e0e7802c75940df4edec4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 36
  2⤵
  - Program crash
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads