Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
01-05-2024 13:58
General
-
Target
0bf909d7edbb48834020654296a99ea1_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
0bf909d7edbb48834020654296a99ea1
-
SHA1
ee3306cbc61fa207fbda73b782f80207cbbf03e1
-
SHA256
210597746fbea00553304ea445d786834b0f0114f9aab82296b1f6fb3103a166
-
SHA512
d7240226d961865346eec5b25fdcbbc3c452e3965d3d9bb68aa456ad0939a077b9edc8fed0fa09e7954fe6b39b4b871f4cd85f8e4277ced505285b3eae137783
-
SSDEEP
24576:CmS8JhYc1PuxlbXXOBCMRC7wmgg48SkQDw:PltWPXegymbS5s
Score
10/10
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bf909d7edbb48834020654296a99ea1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0bf909d7edbb48834020654296a99ea1_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB