Analysis
-
max time kernel
93s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 00:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7efe9fc7329a78d32cf8c7f98f068566_JaffaCakes118.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
7efe9fc7329a78d32cf8c7f98f068566_JaffaCakes118.exe
-
Size
561KB
-
MD5
7efe9fc7329a78d32cf8c7f98f068566
-
SHA1
af6b30e7ca4695453251f7d60b85a515004ee9f5
-
SHA256
49209c0cd75b58e967570eb5a49e9ab2b1533d166c1009e56c242f8e06143ec9
-
SHA512
0002322f51e4673001f2f619191818a1d8766b7a0808237bde07c3b8fbbe5cf945e648a65cc7f7363f8a93417edadd1d05abe2aa29963bda93e2ebe1e3cd3315
-
SSDEEP
12288:BcW1HJ+I3MF7H2Jl7XOwIVN5j3vPJxXLT2CQoLm2v0vQGmDc:5JpJlAN93vPjn24mhvP
Malware Config
Signatures
-
Raccoon Stealer V1 payload 4 IoCs
resource yara_rule behavioral2/memory/1308-2-0x00000000018A0000-0x000000000192E000-memory.dmp family_raccoon_v1 behavioral2/memory/1308-3-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 behavioral2/memory/1308-7-0x00000000018A0000-0x000000000192E000-memory.dmp family_raccoon_v1 behavioral2/memory/1308-10-0x0000000000400000-0x00000000016FF000-memory.dmp family_raccoon_v1 -
Program crash 1 IoCs
pid pid_target Process procid_target 2528 1308 WerFault.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\7efe9fc7329a78d32cf8c7f98f068566_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7efe9fc7329a78d32cf8c7f98f068566_JaffaCakes118.exe"1⤵PID:1308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 12282⤵
- Program crash
PID:2528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1308 -ip 13081⤵PID:1664