Analysis

  • max time kernel
    135s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 18:19

General

  • Target

    70b5d3da94be1618b2fea8d52c33edc2_JaffaCakes118.exe

  • Size

    715KB

  • MD5

    70b5d3da94be1618b2fea8d52c33edc2

  • SHA1

    041e7f096ce8f3081252ae15d914139e19b08457

  • SHA256

    ce64b3e7d99af26d15e6bbe5503a2ae1bdb98090025bdb0c5b05916fb9d90279

  • SHA512

    4d31e49efd346948041795dd1227af4aec97dd4223137cfe1a327c2dcb6c662cbb160379aca31d2452f2a7021a591486f2db87eceea7cab8e3f82c59642fc0fd

  • SSDEEP

    12288:AQPw8J4OG+fMchWnP/ayIEguqi3F3Z4mxxRIQHT0e/ny7p/:AQPJJvdTruQmXRj5nyp/

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\70b5d3da94be1618b2fea8d52c33edc2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\70b5d3da94be1618b2fea8d52c33edc2_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 576
      2⤵
      • Program crash
      PID:224
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1968 -ip 1968
    1⤵
      PID:3616

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1968-0-0x0000000000400000-0x0000000000586000-memory.dmp

            Filesize

            1.5MB

          • memory/1968-1-0x0000000000BB0000-0x0000000000C04000-memory.dmp

            Filesize

            336KB

          • memory/1968-9-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-2-0x0000000000C20000-0x0000000000C21000-memory.dmp

            Filesize

            4KB

          • memory/1968-8-0x0000000000C30000-0x0000000000C31000-memory.dmp

            Filesize

            4KB

          • memory/1968-7-0x0000000000C40000-0x0000000000C41000-memory.dmp

            Filesize

            4KB

          • memory/1968-6-0x0000000000B70000-0x0000000000B71000-memory.dmp

            Filesize

            4KB

          • memory/1968-5-0x0000000000B80000-0x0000000000B81000-memory.dmp

            Filesize

            4KB

          • memory/1968-4-0x0000000000C50000-0x0000000000C51000-memory.dmp

            Filesize

            4KB

          • memory/1968-3-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

            Filesize

            4KB

          • memory/1968-57-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-70-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-69-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-68-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-67-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-66-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-65-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-64-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-63-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-62-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-61-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-60-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-59-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-58-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-56-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-55-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-54-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-53-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-52-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-51-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-50-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-49-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-48-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-47-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-46-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-45-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-44-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-43-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-42-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-41-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-40-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-39-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-38-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-37-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-36-0x0000000002650000-0x0000000002651000-memory.dmp

            Filesize

            4KB

          • memory/1968-35-0x00000000025F0000-0x00000000025F1000-memory.dmp

            Filesize

            4KB

          • memory/1968-34-0x0000000002600000-0x0000000002601000-memory.dmp

            Filesize

            4KB

          • memory/1968-33-0x0000000002620000-0x0000000002621000-memory.dmp

            Filesize

            4KB

          • memory/1968-32-0x0000000002640000-0x0000000002641000-memory.dmp

            Filesize

            4KB

          • memory/1968-31-0x0000000002550000-0x0000000002551000-memory.dmp

            Filesize

            4KB

          • memory/1968-30-0x00000000025D0000-0x00000000025D1000-memory.dmp

            Filesize

            4KB

          • memory/1968-29-0x0000000002590000-0x0000000002591000-memory.dmp

            Filesize

            4KB

          • memory/1968-28-0x00000000025A0000-0x00000000025A1000-memory.dmp

            Filesize

            4KB

          • memory/1968-27-0x0000000002530000-0x0000000002531000-memory.dmp

            Filesize

            4KB

          • memory/1968-26-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/1968-25-0x00000000025C0000-0x00000000025C1000-memory.dmp

            Filesize

            4KB

          • memory/1968-24-0x0000000002560000-0x0000000002561000-memory.dmp

            Filesize

            4KB

          • memory/1968-23-0x0000000002580000-0x0000000002581000-memory.dmp

            Filesize

            4KB

          • memory/1968-22-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-21-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-20-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/1968-19-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-18-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-17-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-16-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-15-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-14-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-13-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-12-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-11-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/1968-10-0x0000000000C60000-0x0000000000C61000-memory.dmp

            Filesize

            4KB

          • memory/1968-71-0x0000000000400000-0x0000000000586000-memory.dmp

            Filesize

            1.5MB

          • memory/1968-72-0x0000000000BB0000-0x0000000000C04000-memory.dmp

            Filesize

            336KB