Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 06:56

General

  • Target

    1119e8ce501dac1c72ebd88286f14500_JaffaCakes118.exe

  • Size

    82KB

  • MD5

    1119e8ce501dac1c72ebd88286f14500

  • SHA1

    ce34fa76676bea35a5fb78faf0725b1373f86da7

  • SHA256

    2862543b053023f0dcd3b75a7e61f30705d2da01826c67fef66b55cc3b68dd5b

  • SHA512

    3b9fb21796d9ed3c6856ae81b4bbaad33384d8fb22a54fba5264ad176dd74aea87c4bdf00612d7f34199755594bf4d66cb24f8fb8fbc937da06e852e91ab9e53

  • SSDEEP

    1536:YLQmripssRZ3RM4I12NOheqjbjJ6/ECkagvDarXJCQes//dZ+M+DQzrSY4wprNTN:YeHI12NsF3YE+gLar4Ns//d9+DQzGY4M

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1119e8ce501dac1c72ebd88286f14500_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1119e8ce501dac1c72ebd88286f14500_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Users\Admin\AppData\Local\Temp\1119e8ce501dac1c72ebd88286f14500_JaffaCakes118mgr.exe
      C:\Users\Admin\AppData\Local\Temp\1119e8ce501dac1c72ebd88286f14500_JaffaCakes118mgr.exe
      2⤵
      • Executes dropped EXE
      PID:4268
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 268
        3⤵
        • Program crash
        PID:948
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4268 -ip 4268
    1⤵
      PID:3300

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1119e8ce501dac1c72ebd88286f14500_JaffaCakes118mgr.exe

      Filesize

      73KB

      MD5

      23842802587d1c2570eec734a06cc188

      SHA1

      aecd57ced1f79fa0dcc93076b3254216d08b907f

      SHA256

      aa94699c1420a0a2c0d07a936fe2acc26cdbb410f7bc47552110504e91b4a8d8

      SHA512

      80ebdf18eff5b25e4ce2dccb44d5b55a9e377b5b339da3a253679d0a4eb0e6fb57595aabb979014aa4e3d59f8622d4660df763d79d8a813365eff0538c05b1c7

    • memory/732-1-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/4268-4-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

    • memory/4268-6-0x0000000000590000-0x0000000000591000-memory.dmp

      Filesize

      4KB

    • memory/4268-7-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB