Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 11:39

General

  • Target

    e275365c0a8684b5dce1b5b626cb8649_JaffaCakes118.exe

  • Size

    9.4MB

  • MD5

    e275365c0a8684b5dce1b5b626cb8649

  • SHA1

    fdb2e76b53e55f5083774349998815c598074e22

  • SHA256

    f4f37faf7b52b7544ee58a029dcc54a71941aedcdd2b4eacda2f39c3217aad48

  • SHA512

    3c8f459d5676274bd0e71e263abff0c8f582a8dc83acc3169aabe98ae6538e58162990c1c405bd81d1ef681451f52af5e17e78f589fffac94151fa05e69533d1

  • SSDEEP

    196608:dlUuy1BuQSR82yCz4M2p9G3ZkOoh+vbXrKDfjOg/JsXHo4ba+:414QSNyCsG3iOzqWhH/bD

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e275365c0a8684b5dce1b5b626cb8649_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e275365c0a8684b5dce1b5b626cb8649_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\UpdateChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\UpdateChecker.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2864
    • C:\Users\Admin\AppData\Local\Temp\Snakyheaded.exe
      "C:\Users\Admin\AppData\Local\Temp\Snakyheaded.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2620

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Snakyheaded.exe

          Filesize

          3.9MB

          MD5

          60da19010d8555edc5d5abf7520a0f6f

          SHA1

          cd3494b05643b5cbe42796a00ce0502259c3483a

          SHA256

          9ff2e5069461fdf638a4fa11c6a89ef53b5c65a74bb08dc0f16b46b885f67221

          SHA512

          177dbefaacc714db3a35b112930dba02ff5725563dacde35dbc2ac5914888be302651caf4fe4239ba0b8ea719c29b409daec024cfbd4f91f09a11ce75d92f500

        • \Users\Admin\AppData\Local\Temp\UpdateChecker.exe

          Filesize

          5.4MB

          MD5

          e3d6dc87f0151a02413405cf24679168

          SHA1

          536c88ef259f430f9982159344878c714408aab0

          SHA256

          473b161ab7fd8802a33d016898f513b190f4e238fcf652755900a182a44a28b7

          SHA512

          82d3dadcc267e0f5f9f31ade49084cc7b56ffc80861d7b124cb6e2e4ec64eceff7d6b02dd6117a342e3bff5045e66a38cae4a940ce6f3c7c6ee4cd90bb81f855

        • memory/2208-17-0x00000000031D0000-0x000000000400E000-memory.dmp

          Filesize

          14.2MB

        • memory/2208-16-0x00000000031C0000-0x0000000003FFE000-memory.dmp

          Filesize

          14.2MB

        • memory/2208-47-0x00000000031D0000-0x000000000400E000-memory.dmp

          Filesize

          14.2MB

        • memory/2620-57-0x0000000000CB0000-0x0000000000D30000-memory.dmp

          Filesize

          512KB

        • memory/2620-31-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

          Filesize

          9.9MB

        • memory/2620-59-0x0000000000CB0000-0x0000000000D30000-memory.dmp

          Filesize

          512KB

        • memory/2620-29-0x0000000001130000-0x000000000151E000-memory.dmp

          Filesize

          3.9MB

        • memory/2620-60-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

          Filesize

          9.9MB

        • memory/2620-56-0x0000000021190000-0x0000000021434000-memory.dmp

          Filesize

          2.6MB

        • memory/2620-55-0x000000001C070000-0x000000001C3D6000-memory.dmp

          Filesize

          3.4MB

        • memory/2620-54-0x0000000000CB0000-0x0000000000D30000-memory.dmp

          Filesize

          512KB

        • memory/2620-49-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

          Filesize

          9.9MB

        • memory/2620-43-0x0000000000CB0000-0x0000000000D30000-memory.dmp

          Filesize

          512KB

        • memory/2620-45-0x0000000000CB0000-0x0000000000D30000-memory.dmp

          Filesize

          512KB

        • memory/2620-42-0x000000001C550000-0x000000001C8C4000-memory.dmp

          Filesize

          3.5MB

        • memory/2864-34-0x00000000750B0000-0x00000000751C0000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-41-0x0000000000190000-0x0000000000FCE000-memory.dmp

          Filesize

          14.2MB

        • memory/2864-39-0x0000000000190000-0x0000000000FCE000-memory.dmp

          Filesize

          14.2MB

        • memory/2864-48-0x0000000000190000-0x0000000000FCE000-memory.dmp

          Filesize

          14.2MB

        • memory/2864-40-0x00000000750B0000-0x00000000751C0000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-50-0x0000000075860000-0x00000000758A7000-memory.dmp

          Filesize

          284KB

        • memory/2864-51-0x00000000750B0000-0x00000000751C0000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-52-0x00000000750B0000-0x00000000751C0000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-53-0x00000000750B0000-0x00000000751C0000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-38-0x0000000077640000-0x0000000077642000-memory.dmp

          Filesize

          8KB

        • memory/2864-37-0x00000000750B0000-0x00000000751C0000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-36-0x0000000075860000-0x00000000758A7000-memory.dmp

          Filesize

          284KB

        • memory/2864-35-0x00000000750B0000-0x00000000751C0000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-33-0x0000000075860000-0x00000000758A7000-memory.dmp

          Filesize

          284KB

        • memory/2864-28-0x0000000000190000-0x0000000000FCE000-memory.dmp

          Filesize

          14.2MB