Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 21:41
Static task
static1
Behavioral task
behavioral1
Sample
54e7afca79ee902a013d073d0e4adf90_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
54e7afca79ee902a013d073d0e4adf90_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
54e7afca79ee902a013d073d0e4adf90_JaffaCakes118.exe
-
Size
732KB
-
MD5
54e7afca79ee902a013d073d0e4adf90
-
SHA1
eeff32a473dd7262180c5b10d934f41c1d7da27f
-
SHA256
1eeb62355e600c625cdbda85f86b2f67a4661f0067f719fe1490af627bfaf505
-
SHA512
ee3c964ce7b663bdafcdf45ff7b61f820a17f47f49295cf53f65f2d50b2c23d9b8a18c9381aad667e01dc5906f118f71fc8590b8116938ac2ba3cb94f73778a2
-
SSDEEP
12288:+0G13bfAP+2vGqJWJvxTg+cJaIobkfgFJHZ9HS4MSPYijzmAVgKG7Q/+hGZcS:BGxeJWtAg7HnH9Qij7G8/+hGZ5
Malware Config
Signatures
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
resource yara_rule behavioral1/memory/2368-2-0x000000001AA70000-0x000000001AAE6000-memory.dmp Core1 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\mcs.exe = "C:\\Users\\Admin\\AppData\\Roaming\\notez\\mcs.exe" 54e7afca79ee902a013d073d0e4adf90_JaffaCakes118.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestseverdops.ddns.netIN AResponseseverdops.ddns.netIN A45.66.231.87
-
Remote address:8.8.8.8:53Requestseverdops.ddns.netIN AResponseseverdops.ddns.netIN A45.66.231.87
-
Remote address:8.8.8.8:53Requestseverdops.ddns.netIN AResponseseverdops.ddns.netIN A45.66.231.87
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 80 B 3 2
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 80 B 3 2
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 80 B 3 2
-
152 B 80 B 3 2
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
64 B 80 B 1 1
DNS Request
severdops.ddns.net
DNS Response
45.66.231.87
-
64 B 80 B 1 1
DNS Request
severdops.ddns.net
DNS Response
45.66.231.87
-
64 B 80 B 1 1
DNS Request
severdops.ddns.net
DNS Response
45.66.231.87