Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe
-
Size
476KB
-
MD5
f4a239b50820825fb1c52aa4ebea2d7e
-
SHA1
5b77955417eed0a5d16670e8d6ad61dda2ac075f
-
SHA256
8560f0d726398fafd868b28403ccd79f32eaa3adc4c7f9289519bfe52dcfed25
-
SHA512
cccea7350b26c794e0f5cfee6c1d1bcbd5db9ed2786064721329201d8d907c7acc0f3d65f90f583617d1b221f192325b58feb816dae2032a11ff73527e55faa7
-
SSDEEP
12288:QYmIjE7eNdKcWEbE2Ubr4TgyUbZm6qCs8e/G:w7eNAYbE2Ub8T5geL
Malware Config
Signatures
-
Expiro payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2340-0-0x0000000000890000-0x000000000099F000-memory.dmp family_expiro1 behavioral1/memory/2340-1-0x0000000000890000-0x000000000099F000-memory.dmp family_expiro1 behavioral1/memory/2340-2-0x0000000000890000-0x000000000099F000-memory.dmp family_expiro1 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2980 2340 WerFault.exe f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exedescription pid process target process PID 2340 wrote to memory of 2980 2340 f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe WerFault.exe PID 2340 wrote to memory of 2980 2340 f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe WerFault.exe PID 2340 wrote to memory of 2980 2340 f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe WerFault.exe PID 2340 wrote to memory of 2980 2340 f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f4a239b50820825fb1c52aa4ebea2d7e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1442⤵
- Program crash
PID:2980