Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
16/06/2024, 16:03
General
- Target b45e57055a3c8fb5c134e18cccde191e_JaffaCakes118.exe
- Size 120KB
- Sample240616-thbmvstdrl
- SHA256 516182949c58c110820c3dc268cabbe715057a49d887e96db47f8b4fc088b8d8
Score
10/10
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Checks QEMU agent state file 2 TTPs 1 IoCs
Checks state file used by QEMU agent, possibly to detect virtualization.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b45e57055a3c8fb5c134e18cccde191e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b45e57055a3c8fb5c134e18cccde191e_JaffaCakes118.exe"1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4952-2-0x00000000021E0000-0x00000000021EC000-memory.dmp
memory/4952-3-0x00000000770F1000-0x0000000077211000-memory.dmp
memory/4952-4-0x00000000021E0000-0x00000000021EC000-memory.dmp