Analysis
- max time kernel
143s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
31/03/2024, 06:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
General
- Target 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe
- Size 24.2MB
- Sample240331-g7w9msfh56
- SHA256 79e74116d9b6641a89f62b78d9b51450612c33cb346d1c86521ce5a8313d24c6
- MD5 4f9a9b1b7da87ecd06db9996d7d4acfe
- SHA1 f813c4b15688d02a467155148c95b75e85aa449f
- SHA512 94e83197964e4a26c2320423c5d587c29f13d955ffaa69dc9ea50b6be5e91bf397bb29f1ff76b24329ad859e8f3c20d81dbf73f8cd39f72efaba4046553034cd
- SSDEEP 393216:3spvgNx6jckByvGeTE0xwtL32JZSlkjWRtuK9JlLir2DrdGPpViRzieLbrK:gvSxBxamXSlll9JZ+0rdyiRzdL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Raccoon Stealer V1 payload 9 IoCs
resource yara_rule behavioral2/memory/2708-20-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-21-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-22-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-23-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-24-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-25-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-26-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-239-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 behavioral2/memory/2708-242-0x0000000000C40000-0x00000000011B1000-memory.dmp family_raccoon_v1 - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AdGuard.v7.7.3715.0.Svc_A42M3.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AdGuard.v7.7.3715.0.Svc_A42M3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AdGuard.v7.7.3715.0.Svc_A42M3.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation AdGuard.v7.7.3715.0_06s5N.exe - Executes dropped EXE 2 IoCs
pid Process 2708 AdGuard.v7.7.3715.0.Svc_A42M3.exe 4540 AdGuard.v7.7.3715.0_06s5N.exe -
resource yara_rule behavioral2/files/0x0005000000016958-4.dat themida behavioral2/memory/2708-17-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-20-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-19-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-21-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-22-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-23-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-24-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-25-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-26-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-239-0x0000000000C40000-0x00000000011B1000-memory.dmp themida behavioral2/memory/2708-242-0x0000000000C40000-0x00000000011B1000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AdGuard.v7.7.3715.0.Svc_A42M3.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2708 AdGuard.v7.7.3715.0.Svc_A42M3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings AdGuard.v7.7.3715.0_06s5N.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 3596 msiexec.exe Token: SeIncreaseQuotaPrivilege 3596 msiexec.exe Token: SeSecurityPrivilege 4432 msiexec.exe Token: SeCreateTokenPrivilege 3596 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3596 msiexec.exe Token: SeLockMemoryPrivilege 3596 msiexec.exe Token: SeIncreaseQuotaPrivilege 3596 msiexec.exe Token: SeMachineAccountPrivilege 3596 msiexec.exe Token: SeTcbPrivilege 3596 msiexec.exe Token: SeSecurityPrivilege 3596 msiexec.exe Token: SeTakeOwnershipPrivilege 3596 msiexec.exe Token: SeLoadDriverPrivilege 3596 msiexec.exe Token: SeSystemProfilePrivilege 3596 msiexec.exe Token: SeSystemtimePrivilege 3596 msiexec.exe Token: SeProfSingleProcessPrivilege 3596 msiexec.exe Token: SeIncBasePriorityPrivilege 3596 msiexec.exe Token: SeCreatePagefilePrivilege 3596 msiexec.exe Token: SeCreatePermanentPrivilege 3596 msiexec.exe Token: SeBackupPrivilege 3596 msiexec.exe Token: SeRestorePrivilege 3596 msiexec.exe Token: SeShutdownPrivilege 3596 msiexec.exe Token: SeDebugPrivilege 3596 msiexec.exe Token: SeAuditPrivilege 3596 msiexec.exe Token: SeSystemEnvironmentPrivilege 3596 msiexec.exe Token: SeChangeNotifyPrivilege 3596 msiexec.exe Token: SeRemoteShutdownPrivilege 3596 msiexec.exe Token: SeUndockPrivilege 3596 msiexec.exe Token: SeSyncAgentPrivilege 3596 msiexec.exe Token: SeEnableDelegationPrivilege 3596 msiexec.exe Token: SeManageVolumePrivilege 3596 msiexec.exe Token: SeImpersonatePrivilege 3596 msiexec.exe Token: SeCreateGlobalPrivilege 3596 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 3596 msiexec.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1624 wrote to memory of 2708 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 86 PID 1624 wrote to memory of 2708 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 86 PID 1624 wrote to memory of 2708 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 86 PID 1624 wrote to memory of 4540 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 88 PID 1624 wrote to memory of 4540 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 88 PID 1624 wrote to memory of 4540 1624 4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe 88 PID 4540 wrote to memory of 3596 4540 AdGuard.v7.7.3715.0_06s5N.exe 89 PID 4540 wrote to memory of 3596 4540 AdGuard.v7.7.3715.0_06s5N.exe 89 PID 4540 wrote to memory of 3596 4540 AdGuard.v7.7.3715.0_06s5N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4f9a9b1b7da87ecd06db9996d7d4acfe_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\ProgramData\AdGuard.v7.7.3715.0.Svc_A42M3.exe"C:\ProgramData\AdGuard.v7.7.3715.0.Svc_A42M3.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2708
-
-
C:\ProgramData\AdGuard.v7.7.3715.0_06s5N.exe"C:\ProgramData\AdGuard.v7.7.3715.0_06s5N.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\ProgramData\Package Cache\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}v7.7.3715.0\setup.msi" TRANSFORMS=tr.mst3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3596
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\AdGuard.v7.7.3715.0_06s5N.exe
- Size 21.3MB
- SHA256 7cdb377bedd16763cea656b92392490d1762c3804214fd80dc734387e9c518f6
- MD5 35b0f868fe979536190b3d4336b18d25
- SHA1 3a337dc2cea9e10ce86b6dd04b907edd509d4318
- SHA512 3c6cb441b72ab50bfca9e03a933abf95979db95c0a0505648fb7bd2a89987477f95ae2611d18613a7ef12b29b991e0b4ce9961afc1f39db63fc9cc03e8828b17
- SSDEEP 393216:0SWKTQKWnJG4gVra9MabzcV0OR+QHwiHWPQSgO6KGkhmXmqpVp3:IOQKcJGVV9wcV0O/HWoShup3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}v7.7.3715.0\setup.msi
- Size 3.7MB
- SHA256 197b90e9201c1c7ba2eec1ed41725f280b2ec341014f45b3e40756f9cff0330e
- MD5 ed6084ab9f2cb4dddcdd796ac353523b
- SHA1 95ace7a94b4ae8efc6f84be9da0ab05c4360f3d7
- SHA512 0e7fb938b76a98afd683caeee3119fd5bb8a8179e3bdb6ed2e16bf4545f46689833df3150ac1df30e0f45c17d091bcded806eaba41aa77ae67b3b97b9f7f6e4d
- SSDEEP 49152:wdPeS9Tdv/1/ah4YpLWrMh77u+nEsx8ZctZOuyDd+/Pln5394F58xfiP+nYD:ccnK8Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}v7.7.3715.0\tr.mst
- Size 300KB
- SHA256 68225c4c5d6c29323403db04f8f87f099b055dc1ea40d14c06c9d9be340d6c60
- MD5 63f3811710ffa84f0fbb7752459177d3
- SHA1 6e6f7d5c8077be9e62e8686846f639dea61da364
- SHA512 3e41ebff35a83f40e7181862db46ab645c5fde5494e5a68ac06ac8c708016f0bbb3a2221c28c7888bb3ac7df54f214d1a0c2c1172c1803cc7a97eb5f041072d2
- SSDEEP 768:I2MAyYdTmPJbgqcnDcmBHzQiofV4MAyYdTmPJbgqcnDcmBHzQiofVo:z1U81cXnfV41U81cXnfVo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\aut4D26.tmp
- Size 2.0MB
- SHA256 c290cebb313e2413bcf84cd70135def846647cf2eca27e9a61ecb71e60cc2e0e
- MD5 b053fb4457f829f8a2cefdd6d4f46d20
- SHA1 d67bd1595c6ebcdbbaa28a7bd35054cecf3daa5f
- SHA512 27371a7fe25431949e20e77330d5b20cef3524bca6652934513a264efcc4379c4277c1386dee6bb8331fb57bd636e87bf7dcb85c6ae9c852cd4c8b92ff6b0636
- SSDEEP 49152:ozX+Y8qoURpqgIy0AG21YdP4AdFc1+hIi6B3/49WEkN:7YD7N9G216P4AdFciIinuN
- MD5 SHA1 SHA512 SSDEEP