Analysis
- max time kernel
141s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
15/07/2024, 02:32
General
- Target 47d8721a8ced3967c82d37b7944d4812_JaffaCakes118.exe
- Size 2.6MB
- Sample240715-c1hqfstfpm
- SHA256 d35506552e0d4d902f8d76a17f3997aafc17fa863e27f5c3407b99e1a81a4228
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47d8721a8ced3967c82d37b7944d4812_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47d8721a8ced3967c82d37b7944d4812_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aviatic.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aviatic.exe2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aviatic.exe
memory/3452-7-0x0000000000400000-0x0000000000535000-memory.dmp
memory/3452-8-0x0000000000459000-0x0000000000518000-memory.dmp
memory/3452-9-0x0000000000400000-0x0000000000535000-memory.dmp
memory/3452-11-0x0000000000459000-0x0000000000518000-memory.dmp