Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 01:31

General

  • Target

    084326949352e9aaf447fa7247da8cd2_JaffaCakes118.exe

  • Size

    8KB

  • MD5

    084326949352e9aaf447fa7247da8cd2

  • SHA1

    b851307d5e634c94fbf46eaa0cf564c2dc0dbd30

  • SHA256

    93f11c91dbe52e65807f931ac434c000ade056a676be9940ef93d689c8733eb7

  • SHA512

    bf29f45c7c11e1ba54d99476585bb6bcc418559ee772b087d8f250c3f012f05b070636b6106cb8a3eb066736ada5b1c3eadfb78bcf3cb669bbbfebeaefa426d4

  • SSDEEP

    192:xqvHHtbLXa5OwjVdaTIDLS1jlf1EPciE9z8tu7vrrnG6O:xuHNvXCOyaMfCRf1EkiEB17jrG6O

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\084326949352e9aaf447fa7247da8cd2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\084326949352e9aaf447fa7247da8cd2_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 36
      2⤵
      • Program crash
      PID:1032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads