Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:51
Static task
static1
Behavioral task
behavioral1
Sample
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
690dea8b1e5230f1539d8df4d3b298b3
-
SHA1
39dcfc1b0c2edccbab807512a74283d731616247
-
SHA256
67d835eb83a752a345c46bd88389980cbed33ebdfaf3b87866d1f7e0264f2171
-
SHA512
7dbbfca3cd229aa2b9be944cfc061f905622b48c9eae7d5a42a83a2708e5abcb332a6ec67ac0332a9d4bb5c923fcd11c00345fdf304ee185cf42b72b31c49553
-
SSDEEP
24576:lWl2/dAjOI9ynxM0/qWJRWajidS4WhA/q:cOCynx4Wyajr4WhQq
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2612 3056 WerFault.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3056 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exedescription pid process target process PID 3056 wrote to memory of 2612 3056 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe WerFault.exe PID 3056 wrote to memory of 2612 3056 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe WerFault.exe PID 3056 wrote to memory of 2612 3056 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe WerFault.exe PID 3056 wrote to memory of 2612 3056 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 24722⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3056-0-0x000000007441E000-0x000000007441F000-memory.dmpFilesize
4KB
-
memory/3056-1-0x0000000000E20000-0x0000000000F30000-memory.dmpFilesize
1.1MB
-
memory/3056-2-0x0000000004540000-0x00000000045F0000-memory.dmpFilesize
704KB
-
memory/3056-3-0x0000000000590000-0x00000000005AC000-memory.dmpFilesize
112KB
-
memory/3056-4-0x0000000074410000-0x0000000074AFE000-memory.dmpFilesize
6.9MB
-
memory/3056-5-0x000000007441E000-0x000000007441F000-memory.dmpFilesize
4KB
-
memory/3056-6-0x0000000074410000-0x0000000074AFE000-memory.dmpFilesize
6.9MB