Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe
-
Size
295KB
-
MD5
28b53af06040db7a67d790aa26cbf6c6
-
SHA1
c71dd623b41f15baa041ad4e4e5c8b77b6b65030
-
SHA256
6438095080694e51e7802ba419e9854234dccdd3cc818eee26cea88f6391177f
-
SHA512
25dfb6ded16ec1bbe1146c886ed1f3527b0c67e1baab8d58300a4f538567f9381b8a1c3a6d999aefc0956abd10c09746a8eac9ef5b0ecdc922ace95f356cf4d0
-
SSDEEP
6144:Q+l/lR8NG2JNUDwxTIxr36LOGZCCCdlEv1BX8NdJF92WvC61:Q+l/lmGUNUDwVIV5i8EvrX85zrvF1
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1760 3876 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3876 wrote to memory of 1428 3876 28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe 86 PID 3876 wrote to memory of 1428 3876 28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe 86 PID 3876 wrote to memory of 1428 3876 28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28b53af06040db7a67d790aa26cbf6c6_JaffaCakes118.exe"2⤵PID:1428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 4322⤵
- Program crash
PID:1760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3876 -ip 38761⤵PID:1040