Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 06:07
General
-
Target
b72f98f14afe9299775ed2da98a77bd7_JaffaCakes118.exe
-
Size
313KB
-
MD5
b72f98f14afe9299775ed2da98a77bd7
-
SHA1
0210f27fbebfadf3a52d06222e50ce596ed2db58
-
SHA256
a92ed67fe05072b2518ca382111a82e236e4bd937f3443952db9af6148e738c7
-
SHA512
419f465cca4f411bf2f7f0fc8a148af74bf415c768f88509deb40dbb82e76478be144fe7ced9e13771643fd84caa3631dbe4734372bcae31c6192a8f83283a74
-
SSDEEP
3072:dQ4omAhLjkbWrJBj/yMEwTMu8IGy6YQ4omTQ4ompr85Cxr85CbQ4omF:KmkfmIBjKw6Ry+mkmF9N9cmF
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b72f98f14afe9299775ed2da98a77bd7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b72f98f14afe9299775ed2da98a77bd7_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
168KB