Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-01-2025 23:30
General
-
Target
JaffaCakes118_0177c423d33507eb5acfbf6180035561.exe
-
Size
136KB
-
MD5
0177c423d33507eb5acfbf6180035561
-
SHA1
fe00bc95807fcc0ab3eebec288e3c35934de1f46
-
SHA256
22600bf939213458b0c557700031593aaf9fe0c2cd90fc330e29748ec66adb03
-
SHA512
389d20c2446f0d1e3c3d1f01f372453c02a7e165ef8ba835ea91e5df4550b32102a44ce88cad442e11f347f8825068dd1aab0cae0f408bf6daf654f893597d1d
-
SSDEEP
1536:7uQk9P70nl81EqOrI0goTQJ6ww7koXXyqqGphcZvnw2:i9D+81EDmAQVwIoYnhnH
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0177c423d33507eb5acfbf6180035561.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0177c423d33507eb5acfbf6180035561.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0177c423d33507eb5acfbf6180035561.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0177c423d33507eb5acfbf6180035561.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
420B
MD5be03a882f6128efad98a06e0adbd34bd
SHA1dda795e9e096ceefa09277c069ebda3bd160a721
SHA256960097c45c628d5f2cdf560c3ec57910ad6ac4519f7cb567cac40521f7f4189c
SHA512e4e6afadcccc09691a38b109e233ac34970a349f53683d7a7b94b055e2808ad54a93577afef7145c2c1eb6167a3a2f582f9f66d13dbd584a7150e4cbb39856f9
-
Filesize
420B
MD5e629a80364df86654dca53c49a4f98ae
SHA17926e76f28e2cd1e6bfe6f41ad659da5bed5e4a3
SHA256198a077d54d11b9d79a8361f9334c1195ffb5250bdcaf8cd940f1384bff8f417
SHA51237156029004d091906984df8ff1562f14db00014c1b3437c0ffbc3c7482ec69844facc8ca1905138afa6a24c5b5d981d03981eca866b9d037dcb65e1d803a9c2
-
Filesize
420B
MD58f2965b4492e6634d63bc5c17fcfd8e0
SHA1cf095d72af02f3441d583b4e7dd9759f579b8fd3
SHA2568c6ffd9af00e505de278bafe8017cd01553cc0d40984ccac25f4e6f09f16977a
SHA5126c2135e8a0e99b7e1c5dd8ff88f1710592c44f064314fdda3896fbee677d554fea28b25fde8287b0214d11a6ca585d9415bfc538ae4e147612fccd276cecdb78
-
Filesize
420B
MD5c336f7c924aa788bbe67a9439a94d0d4
SHA1cb8887e521e967012b5cce91075b245f654cce26
SHA256cf4d191e48ac1c59e8bd2f22c9c577110c86de8faeffb197dab3bb44a33f2946
SHA51295ebfaf53e0e96c823f70a26b5ea465c5ed7d151efd770b1b0777a14732692c6a888a896365fcf74437baccf5b1041daff2a0693b70b7127c1255b4014321ce9
-
Filesize
1.1MB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
1024KB
-
Filesize
1.4MB
-
Filesize
1024KB