226b304ce92e897f7c0b1b5bf4861267b2452e95241eaf08525d84f153dacb65

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe
Size

1024KB
MD5

8db046a709e8b053c57774d3168db7b2
SHA1

4ce699b827ede5c7bd4edc50808e6274e279384b
SHA256

226b304ce92e897f7c0b1b5bf4861267b2452e95241eaf08525d84f153dacb65
SHA512

181120eff687002819bad999600f701a42865ea2a827a4541510e3911e9ffa60dd07df892fc19690faf8ff5f2039327c2b665a36f5e3bbf97a4eba58f2e0e438
SSDEEP

12288:Y6mfpCU7TXk/ACCz7mI2IWtqfg7/LeDJNlVyOw9JBPu4H8BiEE9YYKPKY:Y6mfpv0ICCzKIfksg7K+vcfYK3

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 drive.google.com
3 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2240 2932 WerFault.exe 8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe

flow	ioc
2	drive.google.com
3	drive.google.com

pid	pid_target	process	target process
2240	2932	WerFault.exe	8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe

description	pid	process	target process
PID 2932 wrote to memory of 2240	2932	8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe	WerFault.exe
PID 2932 wrote to memory of 2240	2932	8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe	WerFault.exe
PID 2932 wrote to memory of 2240	2932	8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe	WerFault.exe
PID 2932 wrote to memory of 2240	2932	8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8db046a709e8b053c57774d3168db7b2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 340
2⤵
- Program crash
PID:2240

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads