Analysis

  • max time kernel
    94s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 05:30

General

  • Target

    8d7f3621ca4f677743006e1e44045138_JaffaCakes118.exe

  • Size

    102KB

  • MD5

    8d7f3621ca4f677743006e1e44045138

  • SHA1

    3af5559db7f2cee6226e6a75053552c1d8093635

  • SHA256

    bdc4240c3eb63a76e05a64444705f59569af14b23dcd4ecef872014d2d5812a5

  • SHA512

    f0b1cb8b5da2745172cae9c224865eb3f26c68fd3dce7f6f157d32545b37bc33029849cc36475ec4de80b32cec29b17a7f2bbfd0629905a1938da8346342e342

  • SSDEEP

    3072:hVIf2sZE1T2GADAIATVA6pTcvsiEu3nMTnFb7v:sTE1ajuVA6i+6UVL

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d7f3621ca4f677743006e1e44045138_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d7f3621ca4f677743006e1e44045138_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2164
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 224
      2⤵
      • Program crash
      PID:2000
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2164 -ip 2164
    1⤵
      PID:2392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2164-0-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2164-1-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB