Analysis

  • max time kernel
    142s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 23:01

General

  • Target

    7ad8f09dbf37a9ac38867788146f0116_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    7ad8f09dbf37a9ac38867788146f0116

  • SHA1

    9b7700f89bcddb5227610c53a4bd63f5ed863f1b

  • SHA256

    22ee55d78c8eddf91148df178239e21d9ea4a372d139755e9cb61866dd466796

  • SHA512

    0cdf2180d4fc02556b8547c202ae9aaa9a9a2cdef8c52ab5df55446da8676c848dc03a4392a396bc0d49c5c8305abf575eb6bc30adc92e40d2720b817aec5815

  • SSDEEP

    24576:tcWdcRqqXDRypx3iTY+5qWkEQrtEoH4PC40Rt5:tc5mdjeoHsC3P5

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ad8f09dbf37a9ac38867788146f0116_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7ad8f09dbf37a9ac38867788146f0116_JaffaCakes118.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\7ad8f09dbf37a9ac38867788146f0116_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7ad8f09dbf37a9ac38867788146f0116_JaffaCakes118.exe" Track="0001001000"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-0-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-4-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-6-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-2-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-14-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2940-10-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-17-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-16-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-8-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-18-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-19-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-20-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-21-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-22-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB

  • memory/2940-24-0x0000000000400000-0x0000000000520000-memory.dmp

    Filesize

    1.1MB