Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
29-05-2024 11:04
General
-
Target
8086778c1015d255bfbf3558aa88c4e2_JaffaCakes118.exe
-
Size
629KB
-
MD5
8086778c1015d255bfbf3558aa88c4e2
-
SHA1
23af1b1714fe0286a4031f2798ae19dd4f7305b6
-
SHA256
a073b78de7b2b5d859a17812585f825fbf71fbd940fa208f6853c744c1c64359
-
SHA512
1e9866e7da258279b3bad74b72d2e44eaa7e190f535d630e69206bdd22259889e58481ebd1128aae4006cd98843e5c03bda7feda0efc68eb6c843ed6f22516a2
-
SSDEEP
12288:xy5YtC/DXhT2t6Fm2j/6a7CvLjOFfbwwV+:johT2CXLwwV
Malware Config
Signatures
-
Osiris
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8086778c1015d255bfbf3558aa88c4e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8086778c1015d255bfbf3558aa88c4e2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD50e02149b332c081878bd935a759b7b41
SHA16c0b18413ecd71efccd0150c1692647224dc3e10
SHA25629ea28f91996f8a46ef25c877da969fe994a43764efede3d182f2494becec51c
SHA512a49f4cdc590ad673267730fc855a238f71aea78f894ebb7ff1ac5b48b13630cd3f017f5d89f68fc3c9b5165e5e8e738942d1204e2127043fa9b9c187162d9fc2
-
Filesize
84KB
-
Filesize
47.9MB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
1024KB
-
Filesize
636KB
-
Filesize
336KB
-
Filesize
344KB
-
Filesize
120KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
1024KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
47.9MB