Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-09-2024 06:22
General
-
Target
d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118.exe
-
Size
83KB
-
MD5
d7b4f35ff3c660a0dbfc3ce84a74680d
-
SHA1
eb98f8f283ff2eb7b57a22ebac15978b790fb47f
-
SHA256
d1542300c9eb8ca823956917aeb23fcf00753a11c3fc5a26586e29757ec3a64f
-
SHA512
ac34c7b1c481bd1cc019720827e7e2cdba956860f514debcd24d6e97a2373320afbd2e287875c4d5dd7b41fdc4392eea0419927f2cfb04b522aab114be4abc57
-
SSDEEP
768:eUGKKDVX7piAfvR3uQCQ88ZcoexnnnnnnnnnnnnnnnnnnSqlzI4KklsugzPjk+Ok:ePDRN7Rl7cLa4Kk8zLkpioU/qfxTzdq
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
yyy3
Extracted
Family
smokeloader
Version
2018
C2
http://bloomedanticipated.bid/
http://vijayanagarsanodynes.bid/
http://rabelaissbackgammon.bid/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
68KB