Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 18:31
Behavioral task
behavioral1
Sample
644e8ada1de8c6de2ab8583d8f307b6c_JaffaCakes118.exe
Resource
win7-20240708-en
16 signatures
150 seconds
General
-
Target
644e8ada1de8c6de2ab8583d8f307b6c_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
644e8ada1de8c6de2ab8583d8f307b6c
-
SHA1
ec1214081d0ab640744635bac60434325945c2db
-
SHA256
321d47c4daf81ff7b0a7fa079da61baf1c11684a94a4c20c5dad6c3ed7ad5d19
-
SHA512
eb7717fbdb66e12ece7895aa5a780edc18b2cd4f35f200b5ca60c695e1e261d9ccd0a016e00e3c9da73fe86be035754539a5a689c5b5c4a425dc79e72533c99f
-
SSDEEP
24576:gi0TIWRQqCcetAx6wwS5i6Izo8Cips4ieY+w9+ymnZ5yYcAAz:TWCcetQ6wwSQ/CAfi7+wtmnCFz
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Wine 644e8ada1de8c6de2ab8583d8f307b6c_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2024-0-0x0000000000400000-0x0000000000674000-memory.dmp themida behavioral2/memory/2024-1-0x0000000000400000-0x0000000000674000-memory.dmp themida