Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23-07-2024 22:35

General

  • Target

    6938f5497abc8979c1f0b70dd4c94b33_JaffaCakes118.exe

  • Size

    5.1MB

  • MD5

    6938f5497abc8979c1f0b70dd4c94b33

  • SHA1

    7711769ff3b1a1d9781040aaa9ce6e59e313d271

  • SHA256

    c08e74d3c760b44d372e713633f40ea99832f799227cc87e1aab1006f8ba7b4e

  • SHA512

    6f75ccdb80ff3bc403618d59879d2d29babed2e7068eb1018060febbdc6869d958cb83cc8ac38d5723a1bf81488d19da5f718feee8637ff97ddcd6ef37987b2f

  • SSDEEP

    12288:gzIMBpt1Z9XznASovO2goKqHMClEkQU8OTXHVAB7O3NL7BoesqmfGPwqeu6R1s/N:WHd1ZRz1W6MMCmR5APRUETQUVpnVc5

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6938f5497abc8979c1f0b70dd4c94b33_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6938f5497abc8979c1f0b70dd4c94b33_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 128
      2⤵
      • Program crash
      PID:2232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2104-0-0x0000000000400000-0x000000000091C000-memory.dmp

    Filesize

    5.1MB