Analysis
-
max time kernel
93s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 04:50
Static task
static1
Behavioral task
behavioral1
Sample
d9a4ecfaae2052a1f9c87a832af4bc1a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d9a4ecfaae2052a1f9c87a832af4bc1a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d9a4ecfaae2052a1f9c87a832af4bc1a_JaffaCakes118.exe
-
Size
96KB
-
MD5
d9a4ecfaae2052a1f9c87a832af4bc1a
-
SHA1
358fa5056df5418569556628ef0fd84a89ca3c75
-
SHA256
3323eccd684fde00010a032a1d31c7eb406c2ec2f4a2df8929733dd8c560a95e
-
SHA512
9b3f9a77f787481bac945442021223dc412b46cf9982b8d42c259446636f3854d38ba27e124b95497bbd5ced98d025d059bd54701fae0d7f2570863ea11f7f42
-
SSDEEP
1536:dtjtioHWCnCjXv7WpATNYxluOBchSWSNtNE/uWY4njnB5:dxT23jXqw8lpWSNA//ZnX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1008 4488 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9a4ecfaae2052a1f9c87a832af4bc1a_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4488 d9a4ecfaae2052a1f9c87a832af4bc1a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9a4ecfaae2052a1f9c87a832af4bc1a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d9a4ecfaae2052a1f9c87a832af4bc1a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 6642⤵
- Program crash
PID:1008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4488 -ip 44881⤵PID:1300
Network
-
Remote address:8.8.8.8:53Requestikea.comIN AResponseikea.comIN A23.214.144.98
-
Remote address:8.8.8.8:53Requestsitesell.comIN AResponsesitesell.comIN A172.67.75.143sitesell.comIN A104.26.11.231sitesell.comIN A104.26.10.231
-
Remote address:8.8.8.8:53Requestgoogle.aeIN AResponsegoogle.aeIN A142.250.187.195
-
Remote address:8.8.8.8:53Requestob-gyntest.inIN AResponse
-
Remote address:8.8.8.8:53Requestrooftopjam.inIN AResponse
-
Remote address:8.8.8.8:53Requestjumppack.inIN AResponse
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request59.238.56.23.in-addr.arpaIN PTRResponse59.238.56.23.in-addr.arpaIN PTRa23-56-238-59deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
54 B 70 B 1 1
DNS Request
ikea.com
DNS Response
23.214.144.98
-
58 B 106 B 1 1
DNS Request
sitesell.com
DNS Response
172.67.75.143104.26.11.231104.26.10.231
-
55 B 71 B 1 1
DNS Request
google.ae
DNS Response
142.250.187.195
-
59 B 112 B 1 1
DNS Request
ob-gyntest.in
-
59 B 112 B 1 1
DNS Request
rooftopjam.in
-
57 B 110 B 1 1
DNS Request
jumppack.in
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
59.238.56.23.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa