Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe
Resource
win7-20240903-en
3 signatures
150 seconds
General
-
Target
dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe
-
Size
247KB
-
MD5
dd832c3d9bd3e7af2153083d0a4dee23
-
SHA1
26e5992fac9ce0f5a98c6d90c38d1682f85eec20
-
SHA256
0bc270559f43c03247fffbd193caaae6784837a41231d4221b036acb77d25a47
-
SHA512
ed70a150535ebc7fd917d13c241b7568f2abd7b3b300f8b88b110924cf704f9f00e0877e31e9d328ae628893352d308b176f8af76cc65dc6937d068b7782346c
-
SSDEEP
6144:hqK9loWejbYeLLLOWhqNFZMjOilifiT+r:MWejbL/3QNF6jflifP
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2320 1620 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2320 1620 dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe 30 PID 1620 wrote to memory of 2320 1620 dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe 30 PID 1620 wrote to memory of 2320 1620 dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe 30 PID 1620 wrote to memory of 2320 1620 dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd832c3d9bd3e7af2153083d0a4dee23_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 1602⤵
- Program crash
PID:2320
-