Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 01:11

General

  • Target

    7b32437b76e2bf098fa60d97bb32758d_JaffaCakes118.exe

  • Size

    255KB

  • MD5

    7b32437b76e2bf098fa60d97bb32758d

  • SHA1

    191bf592bfece5d86ce5444e937f8cc1d3f0443f

  • SHA256

    20ff3d3973419b2f36472c76b83db6a156b1768f6cdf1930050b9518309923ac

  • SHA512

    a2ce7621d370e3bfdcecffea769c99ee11b2c0431ec22d14fa6d10a820f2f36c6054c0400859c4fb062215f594297086926d7c6b6b9e55e4c192232577ef343d

  • SSDEEP

    6144:SQo5DV6QKUemrgS5bvIBaOlh9ANPuLMpXCx:k5xKA8S5bypfyNPrXCx

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b32437b76e2bf098fa60d97bb32758d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7b32437b76e2bf098fa60d97bb32758d_JaffaCakes118.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:2812

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2812-0-0x0000000000020000-0x0000000000021000-memory.dmp

          Filesize

          4KB

        • memory/2812-1-0x0000000000030000-0x0000000000031000-memory.dmp

          Filesize

          4KB

        • memory/2812-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/2812-3-0x0000000000100000-0x0000000000101000-memory.dmp

          Filesize

          4KB

        • memory/2812-4-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2812-12-0x00000000001B0000-0x00000000001D7000-memory.dmp

          Filesize

          156KB

        • memory/2812-16-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2812-9-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2812-6-0x0000000000160000-0x000000000018F000-memory.dmp

          Filesize

          188KB

        • memory/2812-18-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB

        • memory/2812-25-0x0000000000110000-0x0000000000139000-memory.dmp

          Filesize

          164KB