Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe
Resource
win7-20240705-en
4 signatures
150 seconds
General
-
Target
a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe
-
Size
652KB
-
MD5
a0a9da7f804db3e631c1e90d5caeb7b3
-
SHA1
fc4a2a31a32f0073de4426d3a4153f31b90b5e83
-
SHA256
c48c72bf9dd886223b789ca3a61b36f52bfd7238ced3a4a171e837b3776e3099
-
SHA512
d7a587411820219b465e3efbcd308885b3f217b3661590f2512043d8dd6429b10812025fb34c40b4d62fb17f67c61df3df9d6dc29b50e842085ef7a19dd76372
-
SSDEEP
12288:tWBscp1EriphBYt22SqfUwr1+tIedanqJBGt/oBHTTWlHRSQlB68hq6Rjpt0:tWaq1Er8hBY4dqfhwIeMqJgtoZ2dgQlE
Score
7/10
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1196 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 21 PID 1984 wrote to memory of 1196 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 21 PID 1984 wrote to memory of 1196 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 21 PID 1984 wrote to memory of 1196 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 21 PID 1984 wrote to memory of 1196 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 21 PID 1984 wrote to memory of 1196 1984 a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0a9da7f804db3e631c1e90d5caeb7b3_JaffaCakes118.exe"2⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
-