Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-08-2024 02:51

General

  • Target

    82c4db2be491292625242fb4614a220f_JaffaCakes118.exe

  • Size

    262KB

  • MD5

    82c4db2be491292625242fb4614a220f

  • SHA1

    f8fa54d01e5e007be8ae04be46587f3b2a4a0c38

  • SHA256

    e2f7435dd7b05813069ab10dac6717f3a2145e9b96d3129c23ceef7d17458cbc

  • SHA512

    0053c62a53dd8f48ca1dc93f59d8627c369466257733f4bb9e28499dc60320cfced9cb53d5938145705f15bc141fe475066bb7d78f1695bce69372067749433d

  • SSDEEP

    6144:wGQXs1u/la03MQi6W1HO7eJo30JCe3efnZeyd0:wGQXs1u/la0NqU7moEIe3tU0

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\82c4db2be491292625242fb4614a220f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\82c4db2be491292625242fb4614a220f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2356
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 412
      2⤵
      • Program crash
      PID:4100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 488
      2⤵
      • Program crash
      PID:3624
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2356 -ip 2356
    1⤵
      PID:1784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2356 -ip 2356
      1⤵
        PID:2584

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\wqiA5E5.tmp

        Filesize

        172KB

        MD5

        4f407b29d53e9eb54e22d096fce82aa7

        SHA1

        a4ee25b066cac19ff679dd491f5791652bb71185

        SHA256

        cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

        SHA512

        325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

      • memory/2356-0-0x0000000000400000-0x000000000040F000-memory.dmp

        Filesize

        60KB

      • memory/2356-7-0x00000000009B0000-0x0000000000A24000-memory.dmp

        Filesize

        464KB

      • memory/2356-8-0x00000000009B0000-0x0000000000A24000-memory.dmp

        Filesize

        464KB

      • memory/2356-11-0x00000000009B0000-0x0000000000A24000-memory.dmp

        Filesize

        464KB

      • memory/2356-10-0x0000000000400000-0x000000000040F000-memory.dmp

        Filesize

        60KB