Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 01:50
Behavioral task
behavioral1
Sample
fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe
-
Size
25KB
-
MD5
fb4643c4eeeb23aafa06bb3c0acf5de2
-
SHA1
a0d1c6508124c505e1913d2388b5944b3e6992a5
-
SHA256
cd44525251607b040ae722917dbfcb69230aa9f5fec7bc3734240ae8583106eb
-
SHA512
9eebcf354497be8e4ba93c0ea761b9d2f6dbd273eff24d80ab7833695309a5249c6879c0450047e48bdc1850a1d7008d2dcc37bd83084acdb79b7932866a8381
-
SSDEEP
384:dGcMJxDTHfRmQ96dMMAd/oB0SYa47iPnwSnlTOY3VHdta6CDLz:tMTDT/RmQwSx6084S1BOY39ba6S
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x000000000040E000-memory.dmp vmprotect behavioral1/memory/3048-1-0x0000000000400000-0x000000000040E000-memory.dmp vmprotect -
Program crash 1 IoCs
pid pid_target Process procid_target 2396 3048 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2396 3048 fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2396 3048 fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2396 3048 fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2396 3048 fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb4643c4eeeb23aafa06bb3c0acf5de2_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 362⤵
- Program crash
PID:2396
-