Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18/08/2024, 15:58
General
-
Target
a74a4526140cd6ddddcc9259e23f6346_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
a74a4526140cd6ddddcc9259e23f6346
-
SHA1
09ef2c0de0c008152d79bc84e56fa312acb95e7a
-
SHA256
5d242f46e401fed8dd2470f96552478ae40299fff73fc6d21299ce83777025f5
-
SHA512
a4b831983a7c78e263ea765f82aaf425e551ff2fa6c4c11605bc6c8ed6abd24453b44ae00d8802e51bd684e61b0eb4259a5e2cbe085b516580004446e5e29d0d
-
SSDEEP
24576:qXuXq4uY5L/89oBnbpI+OECUG3Tt7oM6:qXn4uknnbFOiw9K
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a74a4526140cd6ddddcc9259e23f6346_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a74a4526140cd6ddddcc9259e23f6346_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
-
Filesize
8KB
-
Filesize
1.5MB
-
Filesize
1.5MB