Analysis
-
max time kernel
134s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
a807869d9844ac6fea626f9842c20af7_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a807869d9844ac6fea626f9842c20af7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a807869d9844ac6fea626f9842c20af7_JaffaCakes118.exe
-
Size
492KB
-
MD5
a807869d9844ac6fea626f9842c20af7
-
SHA1
9ab0685690bb35bb5d5b57150f84d054711fbbff
-
SHA256
0324c04a956ca9f931583f7c201c9723ff9174a37f5bbc609feb36b2899eb20c
-
SHA512
ac0d85fe007f222ddb348aa68cb6c47250ed00a0bd6f14579396c151c7bd612dc56ab1febe6f4714cbcb7f78f219f1c7ece5c50feb45dea0bb45836fb8d7c0ef
-
SSDEEP
12288:LGEjUlHrkDKABkk8OHRDCZKL5+dg6raHqoNlT:yEjUlLuGhOHR2ZKL5+dQ5T
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3752 5052 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a807869d9844ac6fea626f9842c20af7_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a807869d9844ac6fea626f9842c20af7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a807869d9844ac6fea626f9842c20af7_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 5562⤵
- Program crash
PID:3752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5052 -ip 50521⤵PID:3924