Overview

overview

3

Static

static

3

cf6478b9eb...18.exe

windows7-x64

3

cf6478b9eb...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 10:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cf6478b9ebfb3a3fefbffc36d73fd4f0_JaffaCakes118.exe

  • Size

    24KB

  • MD5

    cf6478b9ebfb3a3fefbffc36d73fd4f0

  • SHA1

    12dcfbe2248eb7e49151b57e349260262f3ee736

  • SHA256

    1eac737f86f7b227377dfe3695cf93947d6acf3ffd43b479dbc3c37e20348df0

  • SHA512

    30350899d9eb6281513e0bd514b6c731e993676b7b23d93a7419ce82ea5d8993d5507f4cba416f6943281e1a400837a0b78b5beea72aa244f3f1632253a5a5ad

  • SSDEEP

    192:Si+PZ2jwsAAm1UUnj/Z7FxhGQ7v2nPJevtpHG54PtUwLVmyXB9a:Si+h2UvAmyUnjdPp70xkpHDPiwgy

Score
3/10
discovery

Malware Config

Signatures

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf6478b9ebfb3a3fefbffc36d73fd4f0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cf6478b9ebfb3a3fefbffc36d73fd4f0_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2568
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 252
      2⤵
      • Program crash
      PID:2280
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 264
      2⤵
      • Program crash
      PID:3220
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2568 -ip 2568
    1⤵
      PID:4640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2568 -ip 2568
      1⤵
        PID:3580
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4164,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
        1⤵
          PID:3668

        Network

        • flag-us
          DNS
          8.8.8.8.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          8.8.8.8.in-addr.arpa
          IN PTR
          Response
          8.8.8.8.in-addr.arpa
          IN PTR
          dnsgoogle
        • flag-us
          DNS
          241.150.49.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          241.150.49.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          42.56.20.217.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          42.56.20.217.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          75.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          75.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          228.249.119.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          228.249.119.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          103.169.127.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          103.169.127.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          198.187.3.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          198.187.3.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          35.211.222.173.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          35.211.222.173.in-addr.arpa
          IN PTR
          Response
          35.211.222.173.in-addr.arpa
          IN PTR
          a173-222-211-35deploystaticakamaitechnologiescom
        • flag-us
          DNS
          172.214.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.214.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          137.71.105.51.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          137.71.105.51.in-addr.arpa
          IN PTR
          Response
        No results found
        • 8.8.8.8:53
          8.8.8.8.in-addr.arpa
          dns
          66 B
           90 B
           1
          1

          DNS Request

          8.8.8.8.in-addr.arpa

        • 8.8.8.8:53
          241.150.49.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          241.150.49.20.in-addr.arpa

        • 8.8.8.8:53
          42.56.20.217.in-addr.arpa
          dns
          71 B
           131 B
           1
          1

          DNS Request

          42.56.20.217.in-addr.arpa

        • 8.8.8.8:53
          75.159.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          75.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          228.249.119.40.in-addr.arpa
          dns
          73 B
           159 B
           1
          1

          DNS Request

          228.249.119.40.in-addr.arpa

        • 8.8.8.8:53
          103.169.127.40.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          103.169.127.40.in-addr.arpa

        • 8.8.8.8:53
          198.187.3.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          198.187.3.20.in-addr.arpa

        • 8.8.8.8:53
          35.211.222.173.in-addr.arpa
          dns
          73 B
           139 B
           1
          1

          DNS Request

          35.211.222.173.in-addr.arpa

        • 8.8.8.8:53
          172.214.232.199.in-addr.arpa
          dns
          74 B
           128 B
           1
          1

          DNS Request

          172.214.232.199.in-addr.arpa

        • 8.8.8.8:53
          137.71.105.51.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          137.71.105.51.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2568-0-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

          Download

        • memory/2568-1-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.