Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
b991644c171c7bd050cc8350629d2d3e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b991644c171c7bd050cc8350629d2d3e_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
b991644c171c7bd050cc8350629d2d3e_JaffaCakes118.exe
-
Size
130KB
-
MD5
b991644c171c7bd050cc8350629d2d3e
-
SHA1
6765966bd27f6e02c4e608b773cb7cde4994abaa
-
SHA256
9ea06cd1f56ed75fe491a833d795860e7d1a098cde9bad12e5e37a01ca42daab
-
SHA512
4237a3e07ab5b363639d4dcd44649b25c7cb9ddab54f42363d31874e90d5fa93979c5bf3978bd54cc9fad533110d49865cb96224fab701f6598d512266acf527
-
SSDEEP
1536:Q/+2/nOWZqOLANpK4gBt3aLYom28srd5Xw0s43NB7GDNMiuqA4wUb//uIGTphAtH:Q/BnPGNSq41srYCm28B7Fl7IxcWW
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pvhsyr4jsq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b991644c171c7bd050cc8350629d2d3e_JaffaCakes118.exe" b991644c171c7bd050cc8350629d2d3e_JaffaCakes118.exe -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.