Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-10-2024 14:09
Behavioral task
behavioral1
Sample
6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
General
-
Target
6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe
-
Size
44KB
-
MD5
6f516fc30487d64f931c6314d58ff0ec
-
SHA1
7f699f61d1a1d882a4ef49f8077b5bc72df76ac7
-
SHA256
062fc0b47ef5bef2b668047d4ec6f5c88f4afdca0f3b9068bf41ed714b04f713
-
SHA512
b1bbf74bd156cf60ca3287fe7f2eea35d626a7da608af98a5f0f3f7db86eb2abd2bd10d4edcad98456fab6b0e03d2401a826c1a90c3da1087aba0ab4b31951a6
-
SSDEEP
768:rL1mEI7u6rPbzWFy/tjtowL93Wy8Y1aDi8wygJ7l:rJ47Pbz1nowhmy8Wki8TgJx
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2848-0-0x0000000000400000-0x0000000000419000-memory.dmp vmprotect behavioral1/memory/2848-1-0x0000000000400000-0x0000000000419000-memory.dmp vmprotect -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2932 2848 WerFault.exe 6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exedescription pid process target process PID 2848 wrote to memory of 2932 2848 6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe WerFault.exe PID 2848 wrote to memory of 2932 2848 6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe WerFault.exe PID 2848 wrote to memory of 2932 2848 6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe WerFault.exe PID 2848 wrote to memory of 2932 2848 6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f516fc30487d64f931c6314d58ff0ec_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 362⤵
- Program crash
PID:2932