Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 18:28
Static task
static1
Behavioral task
behavioral1
Sample
3c3450eff8c5bdc479070df05827215b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3c3450eff8c5bdc479070df05827215b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
3c3450eff8c5bdc479070df05827215b_JaffaCakes118.exe
-
Size
186KB
-
MD5
3c3450eff8c5bdc479070df05827215b
-
SHA1
8d46d8ff50138c035196697d4d362df5271a0d6b
-
SHA256
b46e446b0b7642b3e0dbfb7189e7e90101ecb36192c10058568c6977f37d4d95
-
SHA512
c85b4618de2526a9819cc1d65111b5e8840cbd3c06f7f8f17289f0faa58e7b001e2194c5e845805ce7b4d7c2905bf628b5cd0f7b98d02c2d39779d47210b0f3d
-
SSDEEP
3072:aRLoaBFWb5AW+CdMNu30OGjSyJkN9LjkrJkfDss:aRb0+mIu3BGjSy2f/k1kf
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3092 116 WerFault.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3450eff8c5bdc479070df05827215b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c3450eff8c5bdc479070df05827215b_JaffaCakes118.exe"1⤵PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 14282⤵
- Program crash
PID:3092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 116 -ip 1161⤵PID:3420