Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2025, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_21c96523ffef7141596f778038e81489.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
JaffaCakes118_21c96523ffef7141596f778038e81489.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_21c96523ffef7141596f778038e81489.exe
-
Size
1.2MB
-
MD5
21c96523ffef7141596f778038e81489
-
SHA1
644ee3e54862ddcc2fcca0a80b3ebbe5fa5d3cdc
-
SHA256
761be35bfcb634db78cfafd575cdacad5f1d1548f8a2aed0b06fcc4f5a8b192e
-
SHA512
31aea96ac659c2786011bdbc73d94e13ed803ac7d2820a71419462e565de7b121562c7b126b91107d3114fb554e0306ae8fc1c936f1baed770ef71fa6e0b3921
-
SSDEEP
24576:Q5Jiux82WOLDMMUTo6S5jSRBJclqLQO6tXaIHPbGRYyVvGnr5pzvtQzc:48ux8ALD7UJC/lyQOMXaITGRYysnVpZ9
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine JaffaCakes118_21c96523ffef7141596f778038e81489.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_21c96523ffef7141596f778038e81489.exe