Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/09/2024, 17:29
General
-
Target
d6cabd460ab5c1547bcaea518c38bed0_JaffaCakes118.exe
-
Size
31KB
-
MD5
d6cabd460ab5c1547bcaea518c38bed0
-
SHA1
a8d0b6bdd1d8c1ddde64a05274943e4e5ab17b63
-
SHA256
db03b00a06360745f0d126ccada6e9658ff943bd351262ecba06f32c07aa630f
-
SHA512
66aba0de4cda4b5e7b5fd35b42ec22f15ae1bad3432a05ca3a3104287b99cd9347ea932c3175a86ff9bbb24052fa98e5fd2c2a9a26625a9ea074232c306a3d09
-
SSDEEP
768:O6aXETFUgD1Ykh19+pzNoF3c0R8fMtowCIAHk36:OhXyWgxYKWzec0RgMqwFAE36
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6cabd460ab5c1547bcaea518c38bed0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d6cabd460ab5c1547bcaea518c38bed0_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
856KB
MD563dc5a3da08308b0dae2fec1fd510456
SHA152e56c376b7f9543dfb3622fb52dbb4b535977b1
SHA2566ee9bcf4de423a3a8a85f300495ddc38ffea9a25471f5e863928c897407daf4e
SHA512a9e902f3a893e88540db58a35b9961a09658e3b972a637a657e7bfd478ac8fd292593a41efdc8304da99fa7074874a92c1193c3ab90c0a7ba99e2d04f64f9c8d
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB