Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 21:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6a12268ae375404fd2b87e1e80a10f1_JaffaCakes118.exe
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
f6a12268ae375404fd2b87e1e80a10f1_JaffaCakes118.exe
-
Size
417KB
-
MD5
f6a12268ae375404fd2b87e1e80a10f1
-
SHA1
e13f789fd191ec112a62042ea48993af0860ae56
-
SHA256
40c02a48e2c4f07dc9e25abbfc83e1daa6869d0e2356fb12c992d1bec38a723e
-
SHA512
964d4adf4811404d0d3defa7f34abb32e79e1b98ea5fc97d830415525f4b6a35fed899dc25ac6b898a7058b9a03a34e585f2ae98ede203e9aad2eb2f50e242f1
-
SSDEEP
6144:PSpwTxz8fEYga22UHHXyDArvBIM6zOR3ONgEox946lzmEZYS5+oj9COdbeOut8MQ:K+lAfEYAtHCDArvxeOwjo46hjYJQ0mN
Malware Config
Signatures
-
Expiro payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4472-0-0x00000000005D0000-0x00000000006CF000-memory.dmp family_expiro1 behavioral2/memory/4472-1-0x00000000005D0000-0x00000000006CF000-memory.dmp family_expiro1 behavioral2/memory/4472-2-0x00000000005D0000-0x00000000006CF000-memory.dmp family_expiro1 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 208 4472 WerFault.exe f6a12268ae375404fd2b87e1e80a10f1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6a12268ae375404fd2b87e1e80a10f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6a12268ae375404fd2b87e1e80a10f1_JaffaCakes118.exe"1⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 2522⤵
- Program crash
PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4472 -ip 44721⤵PID:4236