Analysis
- max time kernel
118s - max time network
118s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
27/05/2024, 19:09
General
- Target 7a3438a342dc6e27679b6e60811a4045_JaffaCakes118.exe
- Size 679KB
- Sample240527-xt6txsff94
- SHA256 20295ccd8f25d0c23fdbd76d081af02c84af34147afd5c127fe694e8af4441df
Score
7/10
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a3438a342dc6e27679b6e60811a4045_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7a3438a342dc6e27679b6e60811a4045_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cab15F2.tmp
memory/2080-0-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2080-37-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2080-38-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2080-39-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2080-40-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/2080-41-0x0000000000400000-0x00000000005CC000-memory.dmp