Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-01-2025 16:47
General
-
Target
JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8.exe
-
Size
527KB
-
MD5
cd2fb5e01efc04746099cfbc0b5b37c8
-
SHA1
123b81d51d47f3f49eaa8f068e7f79773d799497
-
SHA256
0817ae08c918d42b35b03fdb36e8b51237a44b27db5599771bd52e952c5ded3a
-
SHA512
42afcd76db2fd24ed4b8ce1e11b453abf17d4020aad694dbbad49ae53ef1e392a59a0af18bd6afe19757365028bf00026eb8e91b69abe4844d809a8af6617b3e
-
SSDEEP
6144:m9X0GPt/p90FOKWU3TDPTuU4ldQZ7OTcaYEQSh9Ty0y6c4H3yEDFDQMb6Ph0VA4x:I02PWw9C6hlSZ6g2G0yKHp1VbWabfBnB
Malware Config
Signatures
-
Osiris
-
Osiris family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cd2fb5e01efc04746099cfbc0b5b37c8.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD51713969ead08644bbd4860befe1577c7
SHA1a3f0a9205c6f109b36b50f657c99d76e2c6c5722
SHA256fc96d7feef06e028262d5c6b9fd8d3c3cbfb849eda608bcb413d7566df0241b9
SHA5127865465b6996263141506d2b3bb1f9830cf9c2f47b3526ea0a911540674c2443114c76e3e06c94c2f539d37734d9eee20a1495cd35784591ef200b279aef86f1
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
344KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
84KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
120KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB