Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 11:39

General

  • Target

    e275365c0a8684b5dce1b5b626cb8649_JaffaCakes118.exe

  • Size

    9.4MB

  • MD5

    e275365c0a8684b5dce1b5b626cb8649

  • SHA1

    fdb2e76b53e55f5083774349998815c598074e22

  • SHA256

    f4f37faf7b52b7544ee58a029dcc54a71941aedcdd2b4eacda2f39c3217aad48

  • SHA512

    3c8f459d5676274bd0e71e263abff0c8f582a8dc83acc3169aabe98ae6538e58162990c1c405bd81d1ef681451f52af5e17e78f589fffac94151fa05e69533d1

  • SSDEEP

    196608:dlUuy1BuQSR82yCz4M2p9G3ZkOoh+vbXrKDfjOg/JsXHo4ba+:414QSNyCsG3iOzqWhH/bD

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e275365c0a8684b5dce1b5b626cb8649_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e275365c0a8684b5dce1b5b626cb8649_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Users\Admin\AppData\Local\Temp\UpdateChecker.exe
      "C:\Users\Admin\AppData\Local\Temp\UpdateChecker.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3464
    • C:\Users\Admin\AppData\Local\Temp\Snakyheaded.exe
      "C:\Users\Admin\AppData\Local\Temp\Snakyheaded.exe"
      2⤵
      • Executes dropped EXE
      PID:1804

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Snakyheaded.exe

          Filesize

          3.9MB

          MD5

          60da19010d8555edc5d5abf7520a0f6f

          SHA1

          cd3494b05643b5cbe42796a00ce0502259c3483a

          SHA256

          9ff2e5069461fdf638a4fa11c6a89ef53b5c65a74bb08dc0f16b46b885f67221

          SHA512

          177dbefaacc714db3a35b112930dba02ff5725563dacde35dbc2ac5914888be302651caf4fe4239ba0b8ea719c29b409daec024cfbd4f91f09a11ce75d92f500

        • C:\Users\Admin\AppData\Local\Temp\UpdateChecker.exe

          Filesize

          5.4MB

          MD5

          e3d6dc87f0151a02413405cf24679168

          SHA1

          536c88ef259f430f9982159344878c714408aab0

          SHA256

          473b161ab7fd8802a33d016898f513b190f4e238fcf652755900a182a44a28b7

          SHA512

          82d3dadcc267e0f5f9f31ade49084cc7b56ffc80861d7b124cb6e2e4ec64eceff7d6b02dd6117a342e3bff5045e66a38cae4a940ce6f3c7c6ee4cd90bb81f855

        • memory/1804-55-0x00000200403F0000-0x00000200408BC000-memory.dmp

          Filesize

          4.8MB

        • memory/1804-26-0x00007FF8BDF40000-0x00007FF8BEA01000-memory.dmp

          Filesize

          10.8MB

        • memory/1804-25-0x0000020022B30000-0x0000020022F1E000-memory.dmp

          Filesize

          3.9MB

        • memory/1804-57-0x000002003FF40000-0x000002003FF52000-memory.dmp

          Filesize

          72KB

        • memory/1804-59-0x00007FF8BDF40000-0x00007FF8BEA01000-memory.dmp

          Filesize

          10.8MB

        • memory/1804-54-0x000002003FC80000-0x000002003FF24000-memory.dmp

          Filesize

          2.6MB

        • memory/1804-53-0x000002003F910000-0x000002003FC76000-memory.dmp

          Filesize

          3.4MB

        • memory/1804-52-0x0000020024AB0000-0x0000020024AC0000-memory.dmp

          Filesize

          64KB

        • memory/1804-47-0x00007FF8BDF40000-0x00007FF8BEA01000-memory.dmp

          Filesize

          10.8MB

        • memory/1804-44-0x0000020024AB0000-0x0000020024AC0000-memory.dmp

          Filesize

          64KB

        • memory/1804-43-0x0000020024AB0000-0x0000020024AC0000-memory.dmp

          Filesize

          64KB

        • memory/1804-42-0x000002003D3F0000-0x000002003D764000-memory.dmp

          Filesize

          3.5MB

        • memory/3464-40-0x0000000005AB0000-0x0000000005AEC000-memory.dmp

          Filesize

          240KB

        • memory/3464-49-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-38-0x0000000005A50000-0x0000000005A62000-memory.dmp

          Filesize

          72KB

        • memory/3464-41-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

          Filesize

          304KB

        • memory/3464-37-0x0000000006050000-0x0000000006668000-memory.dmp

          Filesize

          6.1MB

        • memory/3464-36-0x00000000000C0000-0x0000000000EFE000-memory.dmp

          Filesize

          14.2MB

        • memory/3464-35-0x00000000000C0000-0x0000000000EFE000-memory.dmp

          Filesize

          14.2MB

        • memory/3464-46-0x00000000000C0000-0x0000000000EFE000-memory.dmp

          Filesize

          14.2MB

        • memory/3464-34-0x0000000077184000-0x0000000077186000-memory.dmp

          Filesize

          8KB

        • memory/3464-39-0x0000000005B80000-0x0000000005C8A000-memory.dmp

          Filesize

          1.0MB

        • memory/3464-48-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-50-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-51-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-30-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-31-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-29-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-28-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-56-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-27-0x0000000076BE0000-0x0000000076CD0000-memory.dmp

          Filesize

          960KB

        • memory/3464-23-0x00000000000C0000-0x0000000000EFE000-memory.dmp

          Filesize

          14.2MB