Overview

overview

7

Static

static

3

368504fed3...18.exe

windows7-x64

7

368504fed3...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 21:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe

  • Size

    31KB

  • MD5

    368504fed3084397dad9fd5a27417b70

  • SHA1

    a263f2aac1c430164d28cdc51310ba5aa5edc788

  • SHA256

    6a8d7f8020d336021170ef09a8379008f7fa51490fda1cb754fdbc108701c123

  • SHA512

    bec60acb11a7e36e365a9fc6d8bec55cbdfb3430c0f320cac14043b0690e6102871589dd5eee01c9dee7aa47e77624c2fe853c248111ded417bcb3757a2299e2

  • SSDEEP

    384:/TwdDqmPyNDmngaRkwe9Uu7VxWiIY58o/ZuGcGh:/EdeT9ma99pHWpi/Zb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\368504fed3084397dad9fd5a27417b70_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\SysWOW64\rst.exe
      C:\Windows\system32\rst.exe
      2⤵
      • Executes dropped EXE
      PID:3536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 500
        3⤵
        • Program crash
        PID:4952
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3536 -ip 3536
    1⤵
      PID:2984

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\rst.exe
      Filesize

      7KB

      MD5

      15ddc23ecdc7d660211516e429ec5e18

      SHA1

      8af01edd8297fd67e6b032bacef93db4c6992322

      SHA256

      9032b59fdee35c4aeb4ff6e4ab1a6d927b36313c7aa909689b7c747f1d2fbf5f

      SHA512

      a82f4bb01f49e1cbc58c3f858a4adbc6d9968b2dc7811e2ff4d3011cb93d783929cff25f951815849650ffd2d7a278575f85b4da89aeaf0fadd00eec26ebdfb6

      Download Submit

    • memory/3536-6-0x0000000000400000-0x0000000000401C00-memory.dmp

      Filesize

      7KB

      Download