Analysis
-
max time kernel
15s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
18/08/2024, 18:39
General
-
Target
a7c78c325d82b1f154d2cc991489d6fa_JaffaCakes118.exe
-
Size
624KB
-
MD5
a7c78c325d82b1f154d2cc991489d6fa
-
SHA1
822c2c80af16a23083b13fca72a14e7036ff530e
-
SHA256
585bff60b415a04e5008d116eb2a63dec4cdba87cd93c90a943b39e656ff0b3b
-
SHA512
19c38312ab4cd46e4cb748f27f6b30d1f56d9b1b3b6cf910bb18db38b8421338a07b2c4a443df649a4013ff25ade1d618ff8ca5d0a510ae0611a683a95436ced
-
SSDEEP
12288:JVKzS47SOnmiTGedDTZA6v/U8wFosbcI6oCfMXtJL3DNsduhQWySf0KY5nh:JT47SOjfhTZrv/U8wumcI6o+oTLvyq89
Score
7/10
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c78c325d82b1f154d2cc991489d6fa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7c78c325d82b1f154d2cc991489d6fa_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
1.4MB