Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-01-2025 08:18

General

  • Target

    JaffaCakes118_033cc6d7203711e871556eb136a01afe.exe

  • Size

    65KB

  • MD5

    033cc6d7203711e871556eb136a01afe

  • SHA1

    f34a1535b15c97708a8fa3a1c12961676fffb55f

  • SHA256

    6646d541b36d78ea2390245c662128fd95a07797755c071d9d868c0e060c43ac

  • SHA512

    7840a2cb0d3e87f2810f50abe80dc8ca8f8ad0729e9bbf87f5ba92591097a3b14a7fa95b89eb240f2dce08e3a82d138a03710dc09922cb6fac5c0cfb7973b228

  • SSDEEP

    1536:Ah8Zc0c2TXH53F/y8fnFZTd6Ue6IWVvmfYC+zyl+U8/6O:k8Zc0hTH53F/y0nzTd6UjIWVvn+o

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_033cc6d7203711e871556eb136a01afe.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_033cc6d7203711e871556eb136a01afe.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 164
      2⤵
      • Program crash
      PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1668-0-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1668-1-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB