General
-
Target
93ab401019239ce60435343c826928a2_JaffaCakes118
-
Size
66KB
-
Sample
240813-swyh4s1fme
-
MD5
93ab401019239ce60435343c826928a2
-
SHA1
f1c22a579320311f6ce64e42b9072548c533e501
-
SHA256
25f7c70d6a55fff5b04843683d7ee8945dd1d50a226ebf36c8128e200fe48e82
-
SHA512
5620ae1d6aefda58f29d42363433d8fd1cbb794a4167b675de1b22e3f56a5a812cfa2ee806578804e34dc66db9ccdaf05fc01914379cad7ea0b1ec66e3005751
-
SSDEEP
1536:ngKGGSw/l2T2wwIEAY8DMwK5Zqh/5AGUGlo+bOwWTPIVfTlacl:nLLl2Y1wYZqh/TZbwTPkTlacl
Static task
static1
Behavioral task
behavioral1
Sample
93ab401019239ce60435343c826928a2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
93ab401019239ce60435343c826928a2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
93ab401019239ce60435343c826928a2_JaffaCakes118
-
Size
66KB
-
MD5
93ab401019239ce60435343c826928a2
-
SHA1
f1c22a579320311f6ce64e42b9072548c533e501
-
SHA256
25f7c70d6a55fff5b04843683d7ee8945dd1d50a226ebf36c8128e200fe48e82
-
SHA512
5620ae1d6aefda58f29d42363433d8fd1cbb794a4167b675de1b22e3f56a5a812cfa2ee806578804e34dc66db9ccdaf05fc01914379cad7ea0b1ec66e3005751
-
SSDEEP
1536:ngKGGSw/l2T2wwIEAY8DMwK5Zqh/5AGUGlo+bOwWTPIVfTlacl:nLLl2Y1wYZqh/TZbwTPkTlacl
Score10/10-
Detects Andromeda payload.
-
Adds policy Run key to start application
-
Deletes itself
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-