Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 16:05

General

  • Target

    7fdd3bf6fe556ac99a332baf9f1ef47c_JaffaCakes118.exe

  • Size

    12KB

  • MD5

    7fdd3bf6fe556ac99a332baf9f1ef47c

  • SHA1

    61dfdc41b868ce2ff7407aa6da1a25c145b0b95c

  • SHA256

    6d79f58d913fc67ad47c344576bece4023eee9ff4a7a6252fe8feb0090bf07be

  • SHA512

    f7c796e0a3af6ead6fc4caa7821e1dd9a403546156039cf76d33d77b17dc31a717683b6e90c18fafc6b58e722accd6663b4d6b94bdf9150a4e385c5e395d591c

  • SSDEEP

    192:J/TrG62a6B10kcg4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMCZgWOS9p:JebFNr4Pk1itKkpAjjJs6B40WCyWOg

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fdd3bf6fe556ac99a332baf9f1ef47c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7fdd3bf6fe556ac99a332baf9f1ef47c_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 140
      2⤵
      • Program crash
      PID:1212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads