Analysis
-
max time kernel
130s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 23:37
Behavioral task
behavioral1
Sample
1cf37cf88af7ab3e29e8bd06f1b8185a_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1cf37cf88af7ab3e29e8bd06f1b8185a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1cf37cf88af7ab3e29e8bd06f1b8185a_JaffaCakes118.exe
-
Size
72KB
-
MD5
1cf37cf88af7ab3e29e8bd06f1b8185a
-
SHA1
c09da9ed794f1d98700ebf6e3f5fa0fc70c5a418
-
SHA256
4890cd98ef3b16d309cb08a7f621a79e16298e7e95f6d64e15cfd51c3af7ce5e
-
SHA512
7efe9fa69e214a63af43b35aa4b683fad62a2269fb379b8b644c2c048ab002126b0cb9a35bbb35f03a57e24da5417f462c8ed335b8108cf9f8d6c7b508c21d53
-
SSDEEP
1536:IRZ/SCHopSENIjEkNgF7Fr7Kgeev1Co6lH/Mb+KR0Nc8QsJq39:QZ/lHAxNITg75v+fe0Nc8QsC9
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 452 2948 WerFault.exe 1cf37cf88af7ab3e29e8bd06f1b8185a_JaffaCakes118.exe 5068 2948 WerFault.exe 1cf37cf88af7ab3e29e8bd06f1b8185a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cf37cf88af7ab3e29e8bd06f1b8185a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1cf37cf88af7ab3e29e8bd06f1b8185a_JaffaCakes118.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 2602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 2682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2948 -ip 29481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2948 -ip 29481⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4532,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2948-0-0x0000000000560000-0x000000000056B000-memory.dmpFilesize
44KB