Resubmissions

05-10-2024 14:22

241005-rpm85avdjr 3

05-10-2024 11:01

241005-m4s1psvgje 10

Analysis

  • max time kernel
    35s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2024 14:22

General

  • Target

    176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe

  • Size

    315KB

  • MD5

    176b04c0ae63ea99ba0ab6414f52576c

  • SHA1

    ac8232cfdf82235a8d4b0984c215c9567bea6322

  • SHA256

    750733fd4c90de2a0003bd6bbc410f61bfc88f1a2b70e6d8846a937b8372807a

  • SHA512

    3a091732ecd94fa3062cc8040f7cb46f13adc1b25dcf12a9b28faf9112d03e3bab44aca94e77c5a432a30984f8607170b9fedc2fb831253f27327c1855e03266

  • SSDEEP

    6144:PZ9vJIpht5cWfs0CKRCITb20o9kWswgR7QqVjcWvCT3dVUJ:PfvJvCs0CKEITbASd/V7CT37G

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe"
      2⤵
        PID:976
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 472
        2⤵
        • Program crash
        PID:4652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4840 -ip 4840
      1⤵
        PID:2956

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4840-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

        Filesize

        1024KB

      • memory/4840-2-0x00000000037E0000-0x00000000037E2000-memory.dmp

        Filesize

        8KB