Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 10:38

General

  • Target

    91796a1a1fab55cfd596c5993942828b_JaffaCakes118.exe

  • Size

    5.0MB

  • MD5

    91796a1a1fab55cfd596c5993942828b

  • SHA1

    30eae7e5fcf18f41525cf2133c00bfc8339bed54

  • SHA256

    709a0f5cdd30bf3c6639c75f894fd331160951242ba1e686a8defbe4d1656772

  • SHA512

    9d0c213831a6fc5dd865c30578c21f2b8b883ce05825e24f9db1ec8e032b26a5df79d9b8bbae7e88331339b8c3a0fdb35f549d857a293fe8e75266a8e8dde39f

  • SSDEEP

    98304:D22YeKFojewsUezO5RCA1dJg1VL0rmNKQpMD5RVxIZsj:y1eKFU9d11rmNVpMD5RHYI

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91796a1a1fab55cfd596c5993942828b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\91796a1a1fab55cfd596c5993942828b_JaffaCakes118.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5068-0-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/5068-2-0x0000000000400000-0x000000000091B000-memory.dmp

    Filesize

    5.1MB

  • memory/5068-3-0x0000000000400000-0x000000000091B000-memory.dmp

    Filesize

    5.1MB

  • memory/5068-4-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB