Analysis
-
max time kernel
140s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-09-2024 06:22
General
-
Target
d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118.exe
-
Size
83KB
-
MD5
d7b4f35ff3c660a0dbfc3ce84a74680d
-
SHA1
eb98f8f283ff2eb7b57a22ebac15978b790fb47f
-
SHA256
d1542300c9eb8ca823956917aeb23fcf00753a11c3fc5a26586e29757ec3a64f
-
SHA512
ac34c7b1c481bd1cc019720827e7e2cdba956860f514debcd24d6e97a2373320afbd2e287875c4d5dd7b41fdc4392eea0419927f2cfb04b522aab114be4abc57
-
SSDEEP
768:eUGKKDVX7piAfvR3uQCQ88ZcoexnnnnnnnnnnnnnnnnnnSqlzI4KklsugzPjk+Ok:ePDRN7Rl7cLa4Kk8zLkpioU/qfxTzdq
Malware Config
Extracted
smokeloader
2018
http://bloomedanticipated.bid/
http://vijayanagarsanodynes.bid/
http://rabelaissbackgammon.bid/
Extracted
smokeloader
yyy3
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d7b4f35ff3c660a0dbfc3ce84a74680d_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
84KB