Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 19:46
Behavioral task
behavioral1
Sample
JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe
-
Size
128KB
-
MD5
622e77b03533c647c4f15afdf56b06bd
-
SHA1
b19141bcc9f40f21ccfda80a8f5a5ebd41ef5417
-
SHA256
f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204
-
SHA512
e60c18c627b2cb9de06e5ae37c557ca97d85b1d8b7d7835369b19dc12b2a9cb2ba96046584e8ea6f837eef24c3dfded7ea6f079c29a0c9b2af08f7dc733a78bf
-
SSDEEP
3072:9jiTCiIMleBDfHllNUH80TCvRIdIYNG+m4OzOh8Urc+5x:9jiTCseB7HlPb0TyRIdIYNG+7OzOh8Yx
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2700 2668 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2700 2668 JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe 31 PID 2668 wrote to memory of 2700 2668 JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe 31 PID 2668 wrote to memory of 2700 2668 JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe 31 PID 2668 wrote to memory of 2700 2668 JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f501b3b5098a4c81dc9e407c2120fb0796f117f28d508c679b100b59d422b204.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 1722⤵
- Program crash
PID:2700
-