Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/10/2024, 21:43
General
-
Target
4453c7e8ff4376a75731e5504ae742b0_JaffaCakes118.exe
-
Size
949KB
-
MD5
4453c7e8ff4376a75731e5504ae742b0
-
SHA1
7c6326f380ca442f03f8b505500789b611f6ee9e
-
SHA256
aadce2dd7ecad35083969d9e75411f9d725c4793cec9cf27c4bcd66ae964d01b
-
SHA512
b731cab0cad10292c014fb4b25a8af85eb63cf385fcf8570f7f37924c922e57be479787484935b291a1167edc479c5df3e4a547017a085785a3654eaa0786381
-
SSDEEP
6144:lq1lujO21bOkL2bsp80mWdmXCtY3clV+c1jsMd/vj4ZdWNMLMsf+5mOmzSF39Qhz:4ai2bwOmXCtY3cdnl/2xhK39QhSaZy
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4453c7e8ff4376a75731e5504ae742b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4453c7e8ff4376a75731e5504ae742b0_JaffaCakes118.exe"1⤵
- Enumerates VirtualBox registry keys
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
4KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
592KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB