Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
21-07-2024 12:03
General
-
Target
6083f37c5b32187bed83131fdf0dcacd_JaffaCakes118.exe
-
Size
473KB
-
MD5
6083f37c5b32187bed83131fdf0dcacd
-
SHA1
594a336b7705d2c36f16932d57d23a0aa108502b
-
SHA256
70c3289dbd2a6ec88ace87705c8305c496b499e3302dc46b674098e72d3a9b7d
-
SHA512
b7f731e67f124488a04b76533e6ca9315efb9122dec1753fc317545957231bf902c334fb9a4a2ddd980c8394d6be4e4c48352b08d50855829b58f6e90659ee96
-
SSDEEP
12288:SY9vvNV5O/it1eJUSpdTh9flf8uT6G4qu7Bf:d9vvbA/4IU0NFku+xqu
Score
9/10
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Drops file in Drivers directory 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6083f37c5b32187bed83131fdf0dcacd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6083f37c5b32187bed83131fdf0dcacd_JaffaCakes118.exe"1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
740KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
528KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
528KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB