Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 17:12

General

  • Target

    4c2bf873680a8b3a7683402c4e927454_JaffaCakes118.exe

  • Size

    914KB

  • MD5

    4c2bf873680a8b3a7683402c4e927454

  • SHA1

    3c18a1acbc8be3de0caa9b6fa1025cf58f7b71c5

  • SHA256

    7f574eccc7ab5287fa1cb3c0e35fe819388a9a0f73bd2243f977d2f2175772e0

  • SHA512

    ffe25102078df09de4fce6feb84a5b927f8b172903a1f03f415b65927635a058acb312d73887ee1221f7e93848134518f5bd625dbcda8c469b782784b96f2e9e

  • SSDEEP

    12288:IHw5jSoveo/+YqiMXIRfm5PgAoB4TqEmvyhhUvogdpMi74zxLqo7t:ow5tvMv0fmJuKOsUvoapkd+ox

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c2bf873680a8b3a7683402c4e927454_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4c2bf873680a8b3a7683402c4e927454_JaffaCakes118.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1132-0-0x0000000002130000-0x000000000220E000-memory.dmp

    Filesize

    888KB

  • memory/1132-2-0x0000000002130000-0x000000000220E000-memory.dmp

    Filesize

    888KB

  • memory/1132-4-0x000000000043B000-0x000000000043C000-memory.dmp

    Filesize

    4KB

  • memory/1132-3-0x0000000000400000-0x0000000000531000-memory.dmp

    Filesize

    1.2MB

  • memory/1132-1-0x0000000002130000-0x000000000220E000-memory.dmp

    Filesize

    888KB

  • memory/1132-5-0x0000000000400000-0x0000000000531000-memory.dmp

    Filesize

    1.2MB

  • memory/1132-6-0x0000000000400000-0x0000000000531000-memory.dmp

    Filesize

    1.2MB

  • memory/1132-7-0x0000000000400000-0x0000000000531000-memory.dmp

    Filesize

    1.2MB

  • memory/1132-8-0x0000000002130000-0x000000000220E000-memory.dmp

    Filesize

    888KB