Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 14:02

General

  • Target

    6374daa20a3c6eb253a2b14a76510c06_JaffaCakes118.exe

  • Size

    918KB

  • MD5

    6374daa20a3c6eb253a2b14a76510c06

  • SHA1

    cc853d739f01b6a4658dd04e23136ab7b8a914b2

  • SHA256

    5b49d8d6a695162d5419ff7c4fb66b675cc3639898516237d7e84040790324bc

  • SHA512

    41f89aa74d27ca8a83de14bfe30c04bdd6e1b8954c5ce12fed107cf8facb8a24db2c6cb2ada00d15e2decc1edc69848ef9aa239ca2b70c9418ba1df25aa67128

  • SSDEEP

    24576:NE8NZMC425ttdFvG2TiLqPTCgJuGpwKkvefRqlcXduCZS7Tskji:NxjXdFu0CgJBpXkvefq2uwS7

Score
7/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6374daa20a3c6eb253a2b14a76510c06_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6374daa20a3c6eb253a2b14a76510c06_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    PID:2740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 892
      2⤵
      • Program crash
      PID:3164
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2740 -ip 2740
    1⤵
      PID:1688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2740-1-0x0000000001000000-0x0000000001572000-memory.dmp

      Filesize

      5.4MB

    • memory/2740-0-0x00000000007D0000-0x0000000000C01000-memory.dmp

      Filesize

      4.2MB

    • memory/2740-2-0x0000000001000000-0x0000000001572000-memory.dmp

      Filesize

      5.4MB

    • memory/2740-3-0x0000000001001000-0x000000000142E000-memory.dmp

      Filesize

      4.2MB

    • memory/2740-5-0x0000000001000000-0x0000000001572000-memory.dmp

      Filesize

      5.4MB

    • memory/2740-6-0x0000000001000000-0x0000000001572000-memory.dmp

      Filesize

      5.4MB

    • memory/2740-7-0x0000000002ED0000-0x0000000003442000-memory.dmp

      Filesize

      5.4MB

    • memory/2740-8-0x0000000001000000-0x0000000001572000-memory.dmp

      Filesize

      5.4MB

    • memory/2740-12-0x0000000001001000-0x000000000142E000-memory.dmp

      Filesize

      4.2MB