0061b41a62485112d82cc44430cdd5ab06dcb815e339f2ed1294eac82f98d91f

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe
Size

519KB
MD5

1b74e59e1d740565d5a82ecfdda24d68
SHA1

cfd95f2b68c65e43be113f707688baadb816fe05
SHA256

0061b41a62485112d82cc44430cdd5ab06dcb815e339f2ed1294eac82f98d91f
SHA512

278306c0b5b1de3348e62c182555c576964b88f9609ef11b16ede1247dcd11fce9d2ca878cf04228a5dc01a54fcaecd8b602cca835bb25962a28014eaafa1ce9
SSDEEP

12288:1e4GIfhwjo71i/Hcg0/ADxyGuyOKxQJsm6jQMUZ3yC:1e4GIfhwjsUfwADxjuyOKxQJt6chdd

Score

7^/10

evasion

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine	1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	2336	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3052	2336	1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe	28
PID 2336 wrote to memory of 3052	2336	1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe	28
PID 2336 wrote to memory of 3052	2336	1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe	28
PID 2336 wrote to memory of 3052	2336	1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b74e59e1d740565d5a82ecfdda24d68_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 264
  2⤵
  - Program crash
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2336-1-0x0000000003B30000-0x0000000003B32000-memory.dmp

Filesize
8KB

Download
memory/2336-2-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/2336-3-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads