30fab45c1ecae14ca0a1ec21213103218d3e5dd133f0804bfb25e32e169f7ea1

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf05026fb6c9a80345b373f816b1f7c_JaffaCakes118.exe
Size

544KB
MD5

faf05026fb6c9a80345b373f816b1f7c
SHA1

f1e7d3df58b28309641eee7a85226b4c05d52b72
SHA256

30fab45c1ecae14ca0a1ec21213103218d3e5dd133f0804bfb25e32e169f7ea1
SHA512

244c90d909bf4191611498a68e488a787c160069bcd143c27a94e4ff003ae2ed76ee36115fee7cdcd8a81c729a791db1c1caa4d65622e2653f1d3770e081add9
SSDEEP

12288:u3d1HHefDphWDUet+hqAdGoD35HH2XdKwc+3KmbuJYkiKWYmb97ukRINni016dVx:uiDODjfA5WNnx31fKWfjRYi0o7x

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	faf05026fb6c9a80345b373f816b1f7c_JaffaCakes118.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3008-0-0x0000000000400000-0x0000000000556000-memory.dmp	themida
behavioral1/memory/3008-1-0x0000000000400000-0x0000000000556000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3008	faf05026fb6c9a80345b373f816b1f7c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\faf05026fb6c9a80345b373f816b1f7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\faf05026fb6c9a80345b373f816b1f7c_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download
memory/3008-1-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download