Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 20:36

General

  • Target

    759fa174ed7e583aa3cc3de254e55a7c_JaffaCakes118.exe

  • Size

    25KB

  • MD5

    759fa174ed7e583aa3cc3de254e55a7c

  • SHA1

    c313546423f425cf9a394947aaeb227b2798c5e6

  • SHA256

    a4062d07bc069af9c466426378c9f71bc1d660186195eed138cb4d97bb78c5ee

  • SHA512

    f9cb7a6b3c2c180be75f09b6afeafb3e3902f9f6a9d83b0477b4391176cd1eff29fadd2fed7929e01a07e810119333b8a5c8f62a6f06fa807d199c5e11f1fcb9

  • SSDEEP

    768:1TCi43PB30Gu9+BugfGPIIf7QYHSKZOwQL5sExm:tCiiBNBheIA1SKBQFLY

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\759fa174ed7e583aa3cc3de254e55a7c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\759fa174ed7e583aa3cc3de254e55a7c_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2344-1-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB