Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 08:28

General

  • Target

    8a866fb96dba09bf13be557d6913ef3c_JaffaCakes118.exe

  • Size

    241KB

  • MD5

    8a866fb96dba09bf13be557d6913ef3c

  • SHA1

    649e380e55d118e34360cb03d408c1cad5cbcd36

  • SHA256

    091d6877583e460a5fe082dc8394007f24fcc78b9858e3e3e4bceaef9db12094

  • SHA512

    93652edd79261df45d5acaff222a321ecea0a90a75d4f4b54fd4e8d21b365e6f6c453064bc01190398ef28bf0fa6b932ee3a82c3193dd038b4fdc97e96017506

  • SSDEEP

    3072:zSBxbVBtXGHa4wtP4nRm0aMO7ypVMa1RNIq/8454oy7Tdhb7QOn01:zSLBXGHTW4nRPFnIY502

Malware Config

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a866fb96dba09bf13be557d6913ef3c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8a866fb96dba09bf13be557d6913ef3c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\8a866fb96dba09bf13be557d6913ef3c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8a866fb96dba09bf13be557d6913ef3c_JaffaCakes118.exe"
      2⤵
        PID:2244

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2244-6-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2244-9-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2244-3-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2244-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2484-4-0x0000000000020000-0x0000000000029000-memory.dmp

      Filesize

      36KB

    • memory/2484-5-0x0000000000940000-0x0000000000A40000-memory.dmp

      Filesize

      1024KB