Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 11:05

General

  • Target

    918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe

  • Size

    258KB

  • MD5

    918d7fcc3ea7583bd23680ce91f4fb47

  • SHA1

    431e157323c52051bc63271c52cc94dba4b345ba

  • SHA256

    ba06ee83b4b1928299aedbb9339c581ab2f38328c48adec2a633f57b86827685

  • SHA512

    6c0731d0ed2850cff98b21e4c01e8e5791397b24e7ca247f51661ebd9c59aaf38f4ecec6a74094e1190d5d3b53974731ca6e035cb526465fa6a2bcb61762847d

  • SSDEEP

    6144:1w7cfNpvcV+rsjSLkObHw0eCazrWHUWvIsyNfG4Zr:tNVjkObHw0eC2URvLkfG4Zr

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:836
  • C:\Users\Admin\AppData\Roaming\Republican Help\Republican Help.exe
    "C:\Users\Admin\AppData\Roaming\Republican Help\Republican Help.exe"
    1⤵
    • Executes dropped EXE
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Republican Help\Republican Help.exe

    Filesize

    64KB

    MD5

    3bc7eb78c8976d47e15336ab9d018686

    SHA1

    12b34b150f8ecafe5d8845f7b8dc46278ba6202a

    SHA256

    6ddb42d774cb64b71d36c5754cb54f55ab89bff44633843c553e9a003ae17784

    SHA512

    98b4c5f8b40de5aa115e11348dcabaaae3125216f68e10ca82f7a1c4b9beb8656d502fe0a112f1ff5ebc2fd7c70ef0e8a0de4bfdb3516f8ffdb0a3514b4e68c7

  • memory/836-0-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/836-1-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/836-2-0x0000000000130000-0x0000000000131000-memory.dmp

    Filesize

    4KB

  • memory/836-3-0x0000000000150000-0x0000000000179000-memory.dmp

    Filesize

    164KB

  • memory/836-4-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/836-5-0x00000000001B0000-0x00000000001DF000-memory.dmp

    Filesize

    188KB

  • memory/836-9-0x0000000000150000-0x0000000000179000-memory.dmp

    Filesize

    164KB

  • memory/836-12-0x0000000000670000-0x0000000000697000-memory.dmp

    Filesize

    156KB

  • memory/836-16-0x0000000000150000-0x0000000000179000-memory.dmp

    Filesize

    164KB

  • memory/836-25-0x0000000000150000-0x0000000000179000-memory.dmp

    Filesize

    164KB