Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27/07/2024, 00:06
General
-
Target
764e793a7dda28c3bb942e7982982916_JaffaCakes118.exe
-
Size
656KB
-
MD5
764e793a7dda28c3bb942e7982982916
-
SHA1
bea8f08ba3034b2cce9f85e22bdead9b91f2a326
-
SHA256
6fc1c3072d21b21d4136a4162c0c81b309874beeb12007ece90eea5c650b1d3f
-
SHA512
9b5ec9629bd247b9f2953dfb89dc9f20847edf43717fe20e1e4d9c29bc77675f2018934134fdec8a6cac059b9d2f1c4007f81cca2d34357a4e104b9dd703197a
-
SSDEEP
12288:N/2rJ2PB7tn8DfYLvz5ebp4IRoDhIDPjNzz7MvVVIcpdqBFT0RK+RZK5ECLY:N/2rJwnh5K5zjNzz7M8ORNfK5ECL
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\764e793a7dda28c3bb942e7982982916_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\764e793a7dda28c3bb942e7982982916_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
12KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB