Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 14:37

General

  • Target

    fcfba5fc5337239796cb5688a092b405_JaffaCakes118.exe

  • Size

    315KB

  • MD5

    fcfba5fc5337239796cb5688a092b405

  • SHA1

    6b95ec2b50e68b585f364b6ddf951019293f2e86

  • SHA256

    760dad5aef9e1024568a7a80a04e8ecea1babfb889eb134515d4a20747e96ace

  • SHA512

    d8b201ff4a1cfe693dc1fb351b0fb21ea537556136842a615b0bafb6c5de94e65e95f5909358d5eaefcaabdd959c8bae26dd44bd7936c2c7e2717688320315ee

  • SSDEEP

    6144:s+fiVFI8E2KgTr6UqNR3L/P6tYHcVarCLWqzWyI:Vqo8EFgTmBX3z6tWJrCjzWyI

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcfba5fc5337239796cb5688a092b405_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fcfba5fc5337239796cb5688a092b405_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Users\Admin\AppData\Local\Temp\fcfba5fc5337239796cb5688a092b405_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fcfba5fc5337239796cb5688a092b405_JaffaCakes118.exe"
      2⤵
        PID:2100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 500
        2⤵
        • Program crash
        PID:4716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3428 -ip 3428
      1⤵
        PID:4440

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3428-0-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

      • memory/3428-1-0x0000000000430000-0x0000000000432000-memory.dmp

        Filesize

        8KB