Analysis
-
max time kernel
92s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/09/2024, 11:37
General
-
Target
fc38b8762e0fb0dab8c637f594da0ad9_JaffaCakes118.exe
-
Size
4.0MB
-
MD5
fc38b8762e0fb0dab8c637f594da0ad9
-
SHA1
3ab5cd11485a9da9ebd1a9c560901d3c5cd4c4a1
-
SHA256
572b3bf1ac5999aded9639de64ce6f92ebbb77c8fb3c1a94e2df6785c75e4971
-
SHA512
6ac45974a3cccf08bd4b85da194a2e31db66c53af6c04ec6df1cc41c2d9ddd9f8390fad70adfb83449e0224dcb2f037a8acda78ba6606e8f825e72e78fe57924
-
SSDEEP
98304:Ef+uRQqdmZJdRMUjvwgxppsA+vmKHcszOGQo6dEIy:EGuPgJfjvBTmct4R
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc38b8762e0fb0dab8c637f594da0ad9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc38b8762e0fb0dab8c637f594da0ad9_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4.3MB