Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-01-2025 02:43

General

  • Target

    JaffaCakes118_622c905a2563762dfac3016d36614e47.exe

  • Size

    348KB

  • MD5

    622c905a2563762dfac3016d36614e47

  • SHA1

    b9dae9470c934bb23e3773bc03e6053713d88bcd

  • SHA256

    dca2dacbab2005cce9bb707e8818edf2c62dbe1d56257ab718e5abbd8748a349

  • SHA512

    b529c1d4f48b9a52a864f711df3863677a147e920af6febb1ac834c3d7c0d10fed4e41d6cd435fcfe4bd43fcc55643095fa3309b8f6854ed24f52194d8d0911a

  • SSDEEP

    6144:MMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOazjE8:MMTi0uhMqe9ts2zWTpMmCG7d

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_622c905a2563762dfac3016d36614e47.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_622c905a2563762dfac3016d36614e47.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_622c905a2563762dfac3016d36614e47mgr.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_622c905a2563762dfac3016d36614e47mgr.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 100
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\JaffaCakes118_622c905a2563762dfac3016d36614e47mgr.exe

    Filesize

    92KB

    MD5

    b5fa407b7ba06a139086f6fe65a317f7

    SHA1

    4c41705144148c2a13285b790b3aec0bfc81876b

    SHA256

    641f27b9724a242dc2391cdd48357c1ea7f53684ab2187e521a07afca0ede662

    SHA512

    9cb6cde83bb24849076b72f736d6778e657e8eab369a2d5368f641eebe3211d7f6233f5a14755b3019a48a481124de61b7671a317d44fcf63dbec3aefe1428cf

  • memory/1944-0-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1944-6-0x0000000000240000-0x0000000000261000-memory.dmp

    Filesize

    132KB

  • memory/1944-9-0x0000000000240000-0x0000000000261000-memory.dmp

    Filesize

    132KB

  • memory/1944-16-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3052-11-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/3052-24-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB