Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 06:16
Static task
static1
Behavioral task
behavioral1
Sample
6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exe
-
Size
259KB
-
MD5
6a01549d89d8e1095ee201d6a1c133e7
-
SHA1
618784ca14895cfb81649499f5da68935ec80a98
-
SHA256
1337a620f678d96f996244e06d1e2d8255aec38a8475c74069fd238fa3ba76e0
-
SHA512
0534df7adc59d4a8762062a9672dcf1ce4f8d9f5adad8838a99af760aefc25ba2b3267be9ef7cc9f63c3c7cea023cf360dcfd03ed235a03f8926ffb365deb465
-
SSDEEP
6144:MWoyc5RL/fvI04xz1oBeRbc2baaWeSa/AdBLKIvfzGN:MWvc5ifKUc6WeSa/AjLKIvfzg
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exedescription ioc process File created C:\Windows\Tasks\PhotoJump.job 6a01549d89d8e1095ee201d6a1c133e7_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1624-0-0x00000000009C0000-0x0000000000A00000-memory.dmpFilesize
256KB
-
memory/1624-2-0x0000000000690000-0x00000000006D0000-memory.dmpFilesize
256KB
-
memory/1624-1-0x0000000000140000-0x0000000000169000-memory.dmpFilesize
164KB
-
memory/1624-7-0x0000000000140000-0x0000000000169000-memory.dmpFilesize
164KB
-
memory/1624-3-0x0000000000570000-0x000000000059F000-memory.dmpFilesize
188KB
-
memory/1624-10-0x0000000000E10000-0x0000000000E37000-memory.dmpFilesize
156KB
-
memory/1624-14-0x0000000000140000-0x0000000000169000-memory.dmpFilesize
164KB
-
memory/1624-20-0x0000000000140000-0x0000000000169000-memory.dmpFilesize
164KB
-
memory/1624-23-0x0000000000140000-0x0000000000169000-memory.dmpFilesize
164KB