Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 19:39
General
-
Target
d4ff90730b69ed04bf7df1b90e987b08_JaffaCakes118.exe
-
Size
645KB
-
MD5
d4ff90730b69ed04bf7df1b90e987b08
-
SHA1
49ed828665a89e0b64199759a10e03c3f99cd45d
-
SHA256
1d3f1c9b09b26e200d4c08e195036b70d94fc37ea253e82077eaba78b3f7c472
-
SHA512
74aaef925c0ba64a6667ef7f033433f7d04da1b1c38e81addc48baca5303b0edb6ec536acf97718389bdfa0c6461fe7a143ff581160b4d2eef2d30989af75813
-
SSDEEP
12288:VqbZSX0K6ASVmDZvthGP2Xukz6sN0czi1QYWQKaplTmRKwac8s2Spxgq0:EkXwASKmW+W0Q9YxhYRKn7S
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4ff90730b69ed04bf7df1b90e987b08_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4ff90730b69ed04bf7df1b90e987b08_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB