Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 06:27

General

  • Target

    eac21fa71a31453aafce021437ccea53_JaffaCakes118.exe

  • Size

    617KB

  • MD5

    eac21fa71a31453aafce021437ccea53

  • SHA1

    095c1a39c466c056200cd1b259f7bc5b1d3b5300

  • SHA256

    10f95519b70b5fe84a6678935b5c4c483634887f87472532abcef85053f184f3

  • SHA512

    cb968b7fb8a7d42d42b71d09f1eaced26783430679b445609454c8f4c9146bc556e1d812736847ed5825f39fdeaec8d5dd329f0ad6fa90ef1a311b7624a5c75b

  • SSDEEP

    12288:9pSiL+mCuvlgNhOThILQ8i6nA3rCdaN9BayRvy7:iVbu9yOmLQ85QSaNLaw2

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\eac21fa71a31453aafce021437ccea53_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eac21fa71a31453aafce021437ccea53_JaffaCakes118.exe"
    1⤵
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • System Location Discovery: System Language Discovery
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1964-0-0x0000000001000000-0x0000000001170000-memory.dmp

    Filesize

    1.4MB

  • memory/1964-1-0x0000000001000000-0x0000000001170000-memory.dmp

    Filesize

    1.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.