Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe
-
Size
344KB
-
MD5
ffce1494f2991769c263191c86bb5c8c
-
SHA1
419dbab81c20404dab80287514db67c2c258b0a6
-
SHA256
8f0de7ca08838b76b67c9338057b9d88afbba4fdfb83cdf4a0290be6e231ad47
-
SHA512
0833ac9bdcdf6c59edf9354dbe25c14fcf3559bdc3bae91cc89138f86fe924ed5a0c1d5bf5af6e92635323b9b271538b505720f14c948408c77119f611346792
-
SSDEEP
6144:/p7akPVHC3JDW4B2Y6yZpJPpTqjRJ/PCUu5MH0VLPpEB9T:1akPxC3k4oY6kLTqfru5zVL
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 348 4208 WerFault.exe regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4084 wrote to memory of 4208 4084 regsvr32.exe regsvr32.exe PID 4084 wrote to memory of 4208 4084 regsvr32.exe regsvr32.exe PID 4084 wrote to memory of 4208 4084 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ffce1494f2991769c263191c86bb5c8c_JaffaCakes118.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4208 -ip 42081⤵