Analysis

  • max time kernel
    23s
  • max time network
    24s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    08-09-2024 19:56

General

  • Target

    d505afacd8043e474a5b2f00dcda97c9_JaffaCakes118.exe

  • Size

    79KB

  • MD5

    d505afacd8043e474a5b2f00dcda97c9

  • SHA1

    71d1e5f9baa4d429d0be549e375f943b8d294880

  • SHA256

    2f9ab0ecaed31282f20a16b2161596f544d2f782038ec253f86852737aecb49f

  • SHA512

    7982d2e624c857287910595412834c7c75f592e8c175a6e20519a26906038e240bbd52a59731f7dc567e8ef1b9c2540373e2073ab7d8667d50290f79cfae556b

  • SSDEEP

    1536:Yk0g6mzr71yAcE9IcdgDR01V8WND+9Pb6QHRT8D/ipecGnBaK:Y+zX1yAcEUDRKoPb6gRT8GQxBaK

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d505afacd8043e474a5b2f00dcda97c9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d505afacd8043e474a5b2f00dcda97c9_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\d505afacd8043e474a5b2f00dcda97c9_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d505afacd8043e474a5b2f00dcda97c9_JaffaCakes118.exe
      2⤵
        PID:2588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 112
        2⤵
        • Program crash
        PID:2728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1040-7-0x0000000000860000-0x0000000000960000-memory.dmp

      Filesize

      1024KB

    • memory/1040-9-0x0000000000860000-0x0000000000960000-memory.dmp

      Filesize

      1024KB

    • memory/1040-10-0x0000000000860000-0x0000000000960000-memory.dmp

      Filesize

      1024KB

    • memory/1040-11-0x0000000000860000-0x0000000000960000-memory.dmp

      Filesize

      1024KB

    • memory/1040-12-0x0000000000860000-0x0000000000960000-memory.dmp

      Filesize

      1024KB

    • memory/1040-13-0x0000000000860000-0x0000000000960000-memory.dmp

      Filesize

      1024KB