Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02/05/2024, 06:24
General
-
Target
0dbf8800ed4d560b1a52169718431a55_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
0dbf8800ed4d560b1a52169718431a55
-
SHA1
c42d696f1d0a0281c48e045f55604ef355685761
-
SHA256
2244fca140090a0d18192bbc23bea336a3a1433c9847b77ceb3486de1d5feb57
-
SHA512
d6b654861de9bd9f7fbdae23fe9d5d73d6e63c30cde63a6b9852146e2a22a9fe46c307fa18d5baf650a2e529ab8d77816e90ae74e446d7c48b2cac462171607d
-
SSDEEP
49152:Zcjlsh7LSBpl6+cAsthBUFvPc9fmpEKBhYLEYAl3bBAGxh4gbi3Zc3yxK5dX2yE8:qm6McP0mpEKLYLgJNAG3rCZFsDXPEDw
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbf8800ed4d560b1a52169718431a55_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0dbf8800ed4d560b1a52169718431a55_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
943KB
MD5dd305582564b7973909265167faacce4
SHA102a8db6c70f328bbad69177d843553405f88fa0f
SHA25658968138a0c8e6f7ab324a50906e29ef2980ccd5b844758fbf64176ea563a42c
SHA5126cac3596c9d254c0d1f86be64affe801a7e887db8936c214431d0504ed19054ea94f747159e1c99e7bb60ad9ce88d1b48e5643fd92788585496eef785d6612cd
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
6.5MB
-
Filesize
1.1MB
-
Filesize
2.4MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB