Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 10:09
Static task
static1
Behavioral task
behavioral1
Sample
916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exe
-
Size
258KB
-
MD5
916467478fc17a8df53c51dbab9c9522
-
SHA1
13a751cc3097c0e21e2adf738f14f6237c251522
-
SHA256
4e8fb5a45103f9c80152f161de02688d1133610ad8fb8774c746cc84bec6d70b
-
SHA512
c55d5b9d8990965fe187f17b694f33a71a00d11129b156033a7d74a989afaf73ce5dca1080a0c9d782a4863316bf85066a1a1d1026454e5ca96cb835cb6636b2
-
SSDEEP
6144:GmcKO3QM2yQ6Q7kJqndSzppmtjD2qKBbHgOSdE:GmclQM2K2SNpqjHKBbHgOSdE
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exedescription ioc process File created C:\Windows\Tasks\MyDriveBuddy.job 916467478fc17a8df53c51dbab9c9522_JaffaCakes118.exe