Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2024 12:53

General

  • Target

    136f6e79bbe2ff0a571bd843a2ca5835_JaffaCakes118.exe

  • Size

    214KB

  • MD5

    136f6e79bbe2ff0a571bd843a2ca5835

  • SHA1

    87d03e962ff86d9796744a433e9ab9dad4aa9b59

  • SHA256

    88fa31a2ce566c6190067b462d7cba5c4c0516f19580f219b425a6a60536ea97

  • SHA512

    175cad74d331e141a6c2b97eaad576a74fcc2115ee14c709b00bfe08ba9666781486b0b371c09285b6b7e056b79bab939630717b4bb6de0549276643a745e7de

  • SSDEEP

    6144:/4JN4r/UcpK0da3m2XtBVsQe8df2w7wO0kFP29G8/4Pm:/+N8Ux3m2ve8I5kB2T8

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\136f6e79bbe2ff0a571bd843a2ca5835_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\136f6e79bbe2ff0a571bd843a2ca5835_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 36
      2⤵
      • Program crash
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2112-0-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/2112-1-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB