Analysis

  • max time kernel
    94s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 13:17

General

  • Target

    b7c887f81611ce644f4279a618b6de3a_JaffaCakes118.exe

  • Size

    492KB

  • MD5

    b7c887f81611ce644f4279a618b6de3a

  • SHA1

    c6b1888836c40621a08e01d44c64cfa7164b41ac

  • SHA256

    4852b88dafe49945c643ceac2baad969b1cd3ed956abead46e4c5b20bda02804

  • SHA512

    b2605f9508d17344b4c66ef3040d30be09eefa7438cc9cedbd340fb7c7160b9bb6d3f5ddd48253c86e9e4f0407c5f50ee992cdac6c98f5f94cfed40c8c48fd2d

  • SSDEEP

    12288:TveVQkTrvj4dJUta7lPGS6GErToTUX9hop+r205G:TyQkTf4dJUta9G9rToTUdrD5G

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7c887f81611ce644f4279a618b6de3a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b7c887f81611ce644f4279a618b6de3a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 632
      2⤵
      • Program crash
      PID:1464
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4016 -ip 4016
    1⤵
      PID:4212

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4016-0-0x0000000000480000-0x00000000004EC000-memory.dmp

      Filesize

      432KB

    • memory/4016-9-0x0000000075680000-0x0000000075681000-memory.dmp

      Filesize

      4KB

    • memory/4016-13-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB

    • memory/4016-15-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB

    • memory/4016-14-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB

    • memory/4016-12-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB

    • memory/4016-11-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB

    • memory/4016-10-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB

    • memory/4016-16-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB

    • memory/4016-17-0x0000000075660000-0x0000000075750000-memory.dmp

      Filesize

      960KB