Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 01:15
Static task
static1
Behavioral task
behavioral1
Sample
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe
-
Size
516KB
-
MD5
2ca017b13019947be76b449d41dcde31
-
SHA1
2af1788f590ffdc3468d454eea212a0da9ff9191
-
SHA256
bb54b67f3738a2044afe0c98327743390a61c4ffaac952610733e3e2677593a5
-
SHA512
38944a948820ec09e5a2b505ccd6c092f38d3a8dacc15405f11b0b2a5030fba1967305c2768661b3be185ac37c55238b40cb7f2bcbf58d7022cdbbeaee63e0d0
-
SSDEEP
3072:MzjXUW4qcmdYo21pqVx7l1tDRhh3F8ZzpWXDSJjCvL0Lmm4ikos7GXpULenWXEwS:MfEW4qg5E3/OZtyWJevitkF/Lenkm
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4912 5112 WerFault.exe 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exepid process 5112 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe 5112 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 6442⤵
- Program crash
PID:4912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 51121⤵PID:4172