Analysis
-
max time kernel
35s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2024 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe
-
Size
315KB
-
MD5
176b04c0ae63ea99ba0ab6414f52576c
-
SHA1
ac8232cfdf82235a8d4b0984c215c9567bea6322
-
SHA256
750733fd4c90de2a0003bd6bbc410f61bfc88f1a2b70e6d8846a937b8372807a
-
SHA512
3a091732ecd94fa3062cc8040f7cb46f13adc1b25dcf12a9b28faf9112d03e3bab44aca94e77c5a432a30984f8607170b9fedc2fb831253f27327c1855e03266
-
SSDEEP
6144:PZ9vJIpht5cWfs0CKRCITb20o9kWswgR7QqVjcWvCT3dVUJ:PfvJvCs0CKEITbASd/V7CT37G
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4652 4840 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4840 wrote to memory of 976 4840 176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe 82 PID 4840 wrote to memory of 976 4840 176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe 82 PID 4840 wrote to memory of 976 4840 176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\176b04c0ae63ea99ba0ab6414f52576c_JaffaCakes118.exe"2⤵PID:976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 4722⤵
- Program crash
PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4840 -ip 48401⤵PID:2956