Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe
-
Size
214KB
-
MD5
c081abc4cf275f28430a8d23f48012cb
-
SHA1
5eb6da9c1eae9e528566a5230f1af33b1ac2b9eb
-
SHA256
18de9cfdc0380b1f6a86eccf657aa0a9edd9f5a74d0940db8507101b2a6c3983
-
SHA512
dc0073d16ea81559753ca29ae05adb9beeae701b5786989c343ee30a7f30cbfe830fea03ff4199940109a4f6902a5e4eeb47af0ac0c143e1a93b25c424b7c35f
-
SSDEEP
6144:aZVRw+rH52/apILDC5V5ioItfa0pPOf3s0h5pYjGxeq84:1YH52ywDee8vs03pfeN4
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1720 2584 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1720 2584 c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1720 2584 c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1720 2584 c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1720 2584 c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c081abc4cf275f28430a8d23f48012cb_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 362⤵
- Program crash
PID:1720
-