Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-12-2024 18:45

General

  • Target

    f02a24dbcb4027872bcf5ba311311b49_JaffaCakes118.exe

  • Size

    186KB

  • MD5

    f02a24dbcb4027872bcf5ba311311b49

  • SHA1

    110c69e46cabdb3b69a103254a19ef2f5c1ee558

  • SHA256

    0191bbffc57c44199f0c1dba0c453d234f67c3cb37de269bc7816c3a834c2a5a

  • SHA512

    3934fc4df43192e4328d14f0c4331f4fc07e819eb8ee36ab6ca92e309be4964711e79c661e88a273824b73bcbb85c81ff4a138ef2e11c1b9e8546406d078bee3

  • SSDEEP

    3072:Xwmbs5fl43JKsDVOa1O3q/kx/ZYA6Bdw/0OXCq86JGncW+mBpoatYOohm7pEus1g:AmkfuzVOrq/kxBadwnSq8Hfpo0YXwOu7

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f02a24dbcb4027872bcf5ba311311b49_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f02a24dbcb4027872bcf5ba311311b49_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4072
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 272
      2⤵
      • Program crash
      PID:4156
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4072 -ip 4072
    1⤵
      PID:1020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads