Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 01:21

General

  • Target

    15598567c73abfffdebae8d4ce56b97d_JaffaCakes118.exe

  • Size

    255KB

  • MD5

    15598567c73abfffdebae8d4ce56b97d

  • SHA1

    5392381a4f4e2c006e2809c139d627b8e939c33a

  • SHA256

    1337071f386be5b35c45bb41f239f66250263d9581f70a1395011b704ca2bdef

  • SHA512

    05c7a5017f67b102e521fdc917ada626a7f0897a52580f2bad0f66682a9ae09c8a099a2697730f1d34974ee5ac61459f2fa485518ab2bbec4330dd538f8bcce6

  • SSDEEP

    6144:hucX6DGemoROHk2iIbU9y4HNI/3rDozDAHLHquVyWxIFdi:gc8GbTbU9yyCPozkrKwFxIFdi

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15598567c73abfffdebae8d4ce56b97d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\15598567c73abfffdebae8d4ce56b97d_JaffaCakes118.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:2868

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2868-1-0x0000000000030000-0x0000000000031000-memory.dmp

          Filesize

          4KB

        • memory/2868-0-0x0000000000020000-0x0000000000021000-memory.dmp

          Filesize

          4KB

        • memory/2868-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/2868-4-0x0000000000180000-0x0000000000181000-memory.dmp

          Filesize

          4KB

        • memory/2868-3-0x00000000001F0000-0x0000000000219000-memory.dmp

          Filesize

          164KB

        • memory/2868-9-0x00000000001F0000-0x0000000000219000-memory.dmp

          Filesize

          164KB

        • memory/2868-6-0x0000000000220000-0x000000000024F000-memory.dmp

          Filesize

          188KB

        • memory/2868-20-0x00000000001F0000-0x0000000000219000-memory.dmp

          Filesize

          164KB

        • memory/2868-18-0x00000000001F0000-0x0000000000219000-memory.dmp

          Filesize

          164KB

        • memory/2868-14-0x0000000000BE0000-0x0000000000C07000-memory.dmp

          Filesize

          156KB

        • memory/2868-25-0x00000000001F0000-0x0000000000219000-memory.dmp

          Filesize

          164KB