Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 23:37

General

  • Target

    f22ed0f6132046c9e8a7545b9c7c3176_JaffaCakes118.exe

  • Size

    259KB

  • MD5

    f22ed0f6132046c9e8a7545b9c7c3176

  • SHA1

    7a50acd9e94626990ce7baf60f249e3907325d7e

  • SHA256

    04645ca682c9b7be6ba8138f728a26bbdb689781b374d22eba72bd6b758b4a74

  • SHA512

    96eded43694bf1c8bc34ead150417b02ac94455ea500937986092cbc1b745706363228d1a896f6b47ca9dc480961541b83c82fb258ad343a4d262cff5d9ba0ea

  • SSDEEP

    3072:B5z1SDuesPSNYH+EqE+Gr0KpTTWB/NykLwEIRbfbsRBRlHIKcrahlgjLPIwR7/:WufhHL+ykGbWZVmqlJwR7/

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f22ed0f6132046c9e8a7545b9c7c3176_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f22ed0f6132046c9e8a7545b9c7c3176_JaffaCakes118.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:2468

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2468-4-0x0000000000100000-0x0000000000101000-memory.dmp

          Filesize

          4KB

        • memory/2468-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/2468-2-0x0000000000030000-0x0000000000031000-memory.dmp

          Filesize

          4KB

        • memory/2468-1-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2468-0-0x0000000000020000-0x0000000000021000-memory.dmp

          Filesize

          4KB

        • memory/2468-9-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2468-5-0x00000000001E0000-0x000000000020F000-memory.dmp

          Filesize

          188KB

        • memory/2468-18-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2468-14-0x0000000000330000-0x0000000000357000-memory.dmp

          Filesize

          156KB

        • memory/2468-20-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2468-25-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB