Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 14:26

General

  • Target

    fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe

  • Size

    97KB

  • MD5

    fa926e73b9e5d4bb792c096ae12b1370

  • SHA1

    2d760185c74f1634e20bf5672c48ccd786ad2300

  • SHA256

    d4552d07f7f179c860b0074cf5e311cc4ec826d1d4bb3e266f39d03264a4fa21

  • SHA512

    668a88ac6c48dc2a048b37597b191a13381993c05dc7cbb5c18bafde706565aa5e762788eef421b97f825912a6587010cae99dd8c224e42b065803b8ef9b8534

  • SSDEEP

    3072:2X7rxJC/5/NVAfD9vmf3p63ek/qSxKuFE53AAwX:2XnxJC/5/NO/qSxKuFi3AAwX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE
      "C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE" C:\Users\Admin\AppData\Local\Temp\fa926e73b9e5d4bb792c096ae12b1370_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 272
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~__UNINST.EXE

    Filesize

    97KB

    MD5

    fa926e73b9e5d4bb792c096ae12b1370

    SHA1

    2d760185c74f1634e20bf5672c48ccd786ad2300

    SHA256

    d4552d07f7f179c860b0074cf5e311cc4ec826d1d4bb3e266f39d03264a4fa21

    SHA512

    668a88ac6c48dc2a048b37597b191a13381993c05dc7cbb5c18bafde706565aa5e762788eef421b97f825912a6587010cae99dd8c224e42b065803b8ef9b8534