Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
31-03-2024 14:06
General
-
Target
5677862f3b7d5b44410e0aa5d5a1cd29_JaffaCakes118.exe
-
Size
937KB
-
MD5
5677862f3b7d5b44410e0aa5d5a1cd29
-
SHA1
612ac9446f6b4766da5ce920531c942d8baa02b2
-
SHA256
eeb66537392c1800f8bf76a83aa5ad8e4bedb49b3b5c5230847527c43eeb6cc8
-
SHA512
405450599c97b99ccb4b01bab5b9e82f9e7c81e2cdde70ccc4fd6d68941529e46570c5c1407c12f061b9b3a9cc892a2235ac50659e315b96c80fb624c798691e
-
SSDEEP
24576:a64FlGzJZlpu2AsIQAPpqztiLn5T4z30y5H7VKJ:a6uQ1w2AsIQA+tqny70yJsJ
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5677862f3b7d5b44410e0aa5d5a1cd29_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5677862f3b7d5b44410e0aa5d5a1cd29_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB