Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 18:31

General

  • Target

    644e8ada1de8c6de2ab8583d8f307b6c_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    644e8ada1de8c6de2ab8583d8f307b6c

  • SHA1

    ec1214081d0ab640744635bac60434325945c2db

  • SHA256

    321d47c4daf81ff7b0a7fa079da61baf1c11684a94a4c20c5dad6c3ed7ad5d19

  • SHA512

    eb7717fbdb66e12ece7895aa5a780edc18b2cd4f35f200b5ca60c695e1e261d9ccd0a016e00e3c9da73fe86be035754539a5a689c5b5c4a425dc79e72533c99f

  • SSDEEP

    24576:gi0TIWRQqCcetAx6wwS5i6Izo8Cips4ieY+w9+ymnZ5yYcAAz:TWCcetQ6wwSQ/CAfi7+wtmnCFz

Score
7/10

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\644e8ada1de8c6de2ab8583d8f307b6c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\644e8ada1de8c6de2ab8583d8f307b6c_JaffaCakes118.exe"
    1⤵
    • Identifies Wine through registry keys
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2024-0-0x0000000000400000-0x0000000000674000-memory.dmp

    Filesize

    2.5MB

  • memory/2024-1-0x0000000000400000-0x0000000000674000-memory.dmp

    Filesize

    2.5MB