Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 17:12

General

  • Target

    a173f589aa5fa4f2e45010ecf3666101_JaffaCakes118.exe

  • Size

    430KB

  • MD5

    a173f589aa5fa4f2e45010ecf3666101

  • SHA1

    b21501cc2b45b859289c50db597b25b44d76368d

  • SHA256

    2f4d373c949d014f7df4be41aacf208e5359bbd6a99c90182d4e75f993948b1d

  • SHA512

    af5fc4a0d115d3b734640593ddcb1e775366c5c54915b96b92f5dca92a9346c7cdc6f6734d9cbd767de2bd9ad190a3714e53a1ceb16b01ddd21f8a8c497617c9

  • SSDEEP

    6144:mYbWW2WDmyUUqK5EhEMDMg48Td50WKtNvGRNxw8QUjw:mhWjmyUUqK5j030TyNC8Q5

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a173f589aa5fa4f2e45010ecf3666101_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a173f589aa5fa4f2e45010ecf3666101_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 116
      2⤵
      • Program crash
      PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2908-0-0x00000000002C0000-0x0000000000330000-memory.dmp

    Filesize

    448KB