Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/04/2024, 22:38

General

  • Target

    ee803a30faacab2fc364faa743f69db6_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    ee803a30faacab2fc364faa743f69db6

  • SHA1

    aaf7edfd74f29fbca916eb2e0d7fc972444f4d1e

  • SHA256

    4c92fc83e50c009b3b03fd3754c3199bf72035225b1f0eb22fd6bbb45c5d9883

  • SHA512

    256b6572ac40a8c580fbd36b4f2dc188ab1a549a68c516815bf626cf78204a1f085c873a8f99ccf0da13fbb03da72d3640f484df3052571bf080dc589ce290bb

  • SSDEEP

    24576:UM040rh3YZMzDL/8xiHqFvswdU7ttxijWpj/NUspgfm8L:UM0lrhsMXLNq5i7ttxFhq/fV

Score
7/10

Malware Config

Signatures

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee803a30faacab2fc364faa743f69db6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee803a30faacab2fc364faa743f69db6_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2492

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2492-1-0x0000000000690000-0x0000000000783000-memory.dmp

          Filesize

          972KB

        • memory/2492-0-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/2492-3-0x0000000004290000-0x0000000004291000-memory.dmp

          Filesize

          4KB

        • memory/2492-2-0x00000000042A0000-0x00000000042A2000-memory.dmp

          Filesize

          8KB

        • memory/2492-6-0x0000000010000000-0x0000000010012000-memory.dmp

          Filesize

          72KB

        • memory/2492-5-0x0000000000400000-0x0000000000683000-memory.dmp

          Filesize

          2.5MB

        • memory/2492-7-0x0000000000400000-0x0000000000683000-memory.dmp

          Filesize

          2.5MB