Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe
Resource
win7-20240903-en
3 signatures
150 seconds
General
-
Target
8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe
-
Size
195KB
-
MD5
8e70b7105035839b36c4af79ab9dc3e7
-
SHA1
ec864e373d03cd56b1ec2ec3ddda159eed49c66c
-
SHA256
e0ba5fab6b8c8001696856c0e1255fbeb1589925b4fdf4561f05dbef000b06a9
-
SHA512
a4dec9c687a8dda095c9a5b413a9de2d15f588d4227fa8212db7bca647c3eed97faec27d08db07c66ef1d1e211f4e74efeb3b721b0ed7dfe3ff3986e88d6524a
-
SSDEEP
3072:rpzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qB8lGpC9SSK1nD:rZRvupm9UX5WflXW5Wc88wG7GpC9yt
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2176 2280 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2176 2280 8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2176 2280 8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2176 2280 8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2176 2280 8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e70b7105035839b36c4af79ab9dc3e7_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 962⤵
- Program crash
PID:2176
-