Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14-05-2024 20:37
General
-
Target
42f863b666068491f41cfcacc57eb711_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
42f863b666068491f41cfcacc57eb711
-
SHA1
073acb2735748c3f14dbfb0b48d5dab8c504094c
-
SHA256
0813dd814b07bb9acf1114bd8a5f4b4b624c667464bac48d91ebd9f9c8e640c7
-
SHA512
acbe1a66b86944dc0c5e4b4f8b54cb392d6e708c04e84e9ef61ffbc85fa70405281f0346d07c164c903aaa394154c0f18578df34bed206b572438f5b307cedd9
-
SSDEEP
24576:XSyLtIBYWFkfV0hfPnZBdWGktI7ie8ydTF4EWCz:DKBlNfPjd1ktOie8y1Fzz
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f863b666068491f41cfcacc57eb711_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42f863b666068491f41cfcacc57eb711_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
848KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
848KB
-
Filesize
2.0MB