Analysis
-
max time kernel
140s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16-05-2024 23:28
General
-
Target
4d8e51aef3a20a478ed61982b3a366b2_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
4d8e51aef3a20a478ed61982b3a366b2
-
SHA1
2d583524130646bc9a689e537fcbe06f04da7f36
-
SHA256
2f0406b56f511aa19d5e9e896e4e86e33768550784b2c97a6bef65b1b60eba6a
-
SHA512
fa40ba4ec2cc1f7c79ae09a224436d587e6cc83119bb9e7668ffc1b6e94fe0c0916ec5f22a6a6eccdd845d2450649997bf630cb3e371030107560823726781c4
-
SSDEEP
24576:kIvEq8jlEBPkNShzxh7QjO+NhXh1l/JFfnE88smZ:zajiNOsbQjOuXh1lvESK
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d8e51aef3a20a478ed61982b3a366b2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d8e51aef3a20a478ed61982b3a366b2_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB