Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
16-06-2024 08:18
General
-
Target
b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe
-
Size
793KB
-
MD5
b2898066b6f6c833c1047ab5e30c3575
-
SHA1
ac45c3ccaa6857469a4e33765149b49904d1aac5
-
SHA256
d7604f4d245bf3521a1e70aa4191db496cf0095ece368f1a4b1fb6825b66e8c7
-
SHA512
ef3568d984e477d9f2292f76b10f34e72496c8cc48555aab13332dd2963785936f5a5a48344b4b1252f6afd1ee6029e277d6f0454c2dba54aba6e2b24834fb50
-
SSDEEP
12288:iAf2vJmTR7QxTRoMgurL5fAor9QPUtZcQcC4rAT6TXSBgM71N9cuy:ixv0kTRoMgu9XBPvXTIM7Xg
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b2898066b6f6c833c1047ab5e30c3575_JaffaCakes118.exe"1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
776KB
-
Filesize
1.1MB
-
Filesize
1.1MB