Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
29/05/2024, 19:31
General
-
Target
81a784f3763a3a85c9bb187c33d4c204_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
81a784f3763a3a85c9bb187c33d4c204
-
SHA1
a3d3d550902b82814f458a8c6e4712b4c70e0d01
-
SHA256
a216fe2dd15110389e7d79a0195d0ffdc731eff5b5d7cf476e91a16b058b9877
-
SHA512
a23b74586c45ac36d8d33c95e02d8ad0648906b801d56beb472119d59c2613db19c4fb5d83447a860e42e0263d086c945acf642f167b3bfa9092e54c66660e0f
-
SSDEEP
12288:CnPuNf+YfgPJy1ZiqqExApJ/klAud08GsmfVx8K/avx/IGCJvFjsVrF3IBD2:cuYYqJyj1Px8JspmVxa/bUFjeF3Ix2
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a784f3763a3a85c9bb187c33d4c204_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81a784f3763a3a85c9bb187c33d4c204_JaffaCakes118.exe"1⤵
- Enumerates VirtualBox registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
4KB
-
Filesize
992KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB