Analysis
- max time kernel
120s - max time network
120s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
04/06/2024, 02:00
General
- Target 93582e54a7ee88a8670d2f47a797136e_JaffaCakes118.exe
- Size 679KB
- Sample240604-ce4e2ahe5z
- SHA256 14d09a3807abce5ceacf2ac1e03ae1894d715c993f473959d40e055618a24c4f
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93582e54a7ee88a8670d2f47a797136e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\93582e54a7ee88a8670d2f47a797136e_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1692-0-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-19-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-20-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-21-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-22-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-23-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-24-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-25-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-26-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/1692-28-0x0000000000400000-0x00000000005CC000-memory.dmp