Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe
-
Size
344KB
-
MD5
ffce1494f2991769c263191c86bb5c8c
-
SHA1
419dbab81c20404dab80287514db67c2c258b0a6
-
SHA256
8f0de7ca08838b76b67c9338057b9d88afbba4fdfb83cdf4a0290be6e231ad47
-
SHA512
0833ac9bdcdf6c59edf9354dbe25c14fcf3559bdc3bae91cc89138f86fe924ed5a0c1d5bf5af6e92635323b9b271538b505720f14c948408c77119f611346792
-
SSDEEP
6144:/p7akPVHC3JDW4B2Y6yZpJPpTqjRJ/PCUu5MH0VLPpEB9T:1akPxC3k4oY6kLTqfru5zVL
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2668 1752 WerFault.exe regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1284 wrote to memory of 1752 1284 regsvr32.exe regsvr32.exe PID 1284 wrote to memory of 1752 1284 regsvr32.exe regsvr32.exe PID 1284 wrote to memory of 1752 1284 regsvr32.exe regsvr32.exe PID 1284 wrote to memory of 1752 1284 regsvr32.exe regsvr32.exe PID 1284 wrote to memory of 1752 1284 regsvr32.exe regsvr32.exe PID 1284 wrote to memory of 1752 1284 regsvr32.exe regsvr32.exe PID 1284 wrote to memory of 1752 1284 regsvr32.exe regsvr32.exe PID 1752 wrote to memory of 2668 1752 regsvr32.exe WerFault.exe PID 1752 wrote to memory of 2668 1752 regsvr32.exe WerFault.exe PID 1752 wrote to memory of 2668 1752 regsvr32.exe WerFault.exe PID 1752 wrote to memory of 2668 1752 regsvr32.exe WerFault.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 2963⤵
- Program crash