Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 06:49

General

  • Target

    eaca7236a7ba26ff16acbe37003d3118_JaffaCakes118.exe

  • Size

    325KB

  • MD5

    eaca7236a7ba26ff16acbe37003d3118

  • SHA1

    49777c84aaf0ebd70f482b5c8514182137dadd6f

  • SHA256

    126103fce4b85b99e4204ff84bfd7459ca4412297ec087c4f7b195b4762393e1

  • SHA512

    a8e56f9768111556bacd3eea7a2656a94d78bb364345c649292154ae9b44e478d30322b90141c2a687534648e85754b4d56a749cce88af3284160590f7619622

  • SSDEEP

    6144:uyZckaPOMCHBJuzEasMXIKfJHQU0SNJi9wXzkx3qHu/j:uNtP4FapIKfJHQU0go+AqI

Score
7/10

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eaca7236a7ba26ff16acbe37003d3118_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eaca7236a7ba26ff16acbe37003d3118_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 116
      2⤵
      • Program crash
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2160-3-0x0000000010000000-0x0000000010020000-memory.dmp

    Filesize

    128KB

  • memory/2160-2-0x0000000010000000-0x0000000010020000-memory.dmp

    Filesize

    128KB

  • memory/2160-0-0x0000000010000000-0x0000000010020000-memory.dmp

    Filesize

    128KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.