Analysis
-
max time kernel
133s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 15:24
General
-
Target
b3ff384028803d77f1157ae0c8418863_JaffaCakes118.exe
-
Size
10.3MB
-
MD5
b3ff384028803d77f1157ae0c8418863
-
SHA1
92ba017634ce395c1cec797852b04f44bfefe219
-
SHA256
7434fcbd1b4fe852364e7d60e749fe887f904dfcf2533001734b79016ff17e28
-
SHA512
fc0056523fcdf016f7c76be96399760ad99a050c5af68b837c04e7cd9ac5c373a4b6d2c98c562555bac41b8554f994c7f9a45c9e42df13b9370fbc766930bc8b
-
SSDEEP
98304:COaEzgPWutZXIfEWVv0/7L/+3RfFdDanPSwAd5/Ab+KqPIpD6biW0yZhHZK4vnMx:CjFWIi5YboIknRH84vnFn9
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3ff384028803d77f1157ae0c8418863_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b3ff384028803d77f1157ae0c8418863_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.4MB
-
Filesize
4KB
-
Filesize
10.4MB
-
Filesize
4KB