Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 20:19

General

  • Target

    49d1fd020c8f136f933673d630e18d4b_JaffaCakes118.exe

  • Size

    900KB

  • MD5

    49d1fd020c8f136f933673d630e18d4b

  • SHA1

    b4dcb8d4a0e5822894187a5ac1825cda7489bb13

  • SHA256

    8fc6b1edf12b69ec825bd1e8eb04235fc2aadca0dc13a7c29783555bb2651383

  • SHA512

    58896bc70173a4ad995db5c8c2cc38d69f7c4c09fc237d1fe68f26ad36728f8e44512d36fbfdc1c3157f04c66b9499dd6e3d9451687688d6263a5075e44cc9ca

  • SSDEEP

    24576:Vnx62v7sR55S7C9cSGfOKfUk7FsaXHSqb:VDDsH5HaDL5nXF

Score
6/10

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49d1fd020c8f136f933673d630e18d4b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49d1fd020c8f136f933673d630e18d4b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\49d1fd020c8f136f933673d630e18d4b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\49d1fd020c8f136f933673d630e18d4b_JaffaCakes118.exe"
      2⤵
      • Checks for any installed AV software in registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Windows\SysWOW64\WerFault.exe
        "C:\Windows\SysWOW64\WerFault.exe"
        3⤵
          PID:2272

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2084-18-0x0000000000400000-0x00000000004E8000-memory.dmp

            Filesize

            928KB

          • memory/2084-1-0x00000000003D0000-0x00000000003D7000-memory.dmp

            Filesize

            28KB

          • memory/2084-0-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2088-9-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2088-13-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-19-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-11-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-4-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-7-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-15-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-22-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-20-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/2088-23-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

          • memory/2088-24-0x0000000000450000-0x00000000004B7000-memory.dmp

            Filesize

            412KB

          • memory/2272-26-0x0000000077910000-0x0000000077A91000-memory.dmp

            Filesize

            1.5MB

          • memory/2272-27-0x0000000000210000-0x000000000033F000-memory.dmp

            Filesize

            1.2MB

          • memory/2272-28-0x0000000077910000-0x0000000077A91000-memory.dmp

            Filesize

            1.5MB

          • memory/2272-29-0x0000000000210000-0x000000000033F000-memory.dmp

            Filesize

            1.2MB