Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:14
Static task
static1
Behavioral task
behavioral1
Sample
1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe
-
Size
83KB
-
MD5
1c02e9c7182d4d098a28b1f941d66312
-
SHA1
a2fbeead323da6bc75698d31c766ab32e31f455a
-
SHA256
f0132358f58f290ac5490b9c27be8cb09737e7e250d9dec5bf5fef80988d8da6
-
SHA512
18cbb36724bb3acd42c0d4aa16047df5a98a625d089e6b5eff63f233d4fcdfbc7202c61982918756706fd8404ac0908526c1af65fa73c77fe1d72f27ef82df7a
-
SSDEEP
1536:bODUngi71V1f8TjQDkF2l3BPoesXv8So3fpl1hFas:KDUngiD1f8TjQDkF21lHO8SkPh
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exepid process 2884 1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe 2884 1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2884-4-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2884-7-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2884-6-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2884-5-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2884-3-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2884-2-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2884-1-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2884-19-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2160 2884 WerFault.exe 1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exepid process 2884 1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c02e9c7182d4d098a28b1f941d66312_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 682⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\~TMB18.tmpFilesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
\Users\Admin\AppData\Local\Temp\~TMB38.tmpFilesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
memory/2884-12-0x0000000077B1F000-0x0000000077B21000-memory.dmpFilesize
8KB
-
memory/2884-9-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2884-14-0x0000000077B20000-0x0000000077B22000-memory.dmpFilesize
8KB
-
memory/2884-13-0x0000000077B20000-0x0000000077B21000-memory.dmpFilesize
4KB
-
memory/2884-4-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-5-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-3-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-2-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-1-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-0-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2884-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-19-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB