Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07-04-2024 10:34
General
-
Target
e4b908985c9010780f9bc972dc34883e_JaffaCakes118.exe
-
Size
24.1MB
-
MD5
e4b908985c9010780f9bc972dc34883e
-
SHA1
a4b802e0e4c9485d4733f2f8e836cccef17cc587
-
SHA256
0a3a36fb5bca270716b5836355d506fbde4dcfeb66c526d7310aa60f99aac49b
-
SHA512
69c3533ab9a95f9330001720cf4ccde47eafc203b416b4aadb7352831b7f7a8c02e0543543c0bc443b5f8915fb834f614b3a0c580eefc1f914dbdb3df0fa7b1d
-
SSDEEP
393216:D8zGfF0zm9Vj2bVl8WvEOcc2FReqN14JkgKTLDF9Ky9LWN1QsTFrdRSqPPF+:8GN0zOVW8WM3DHvJDF9KPN1ntdPPF+
Malware Config
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V1 payload 8 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4b908985c9010780f9bc972dc34883e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e4b908985c9010780f9bc972dc34883e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Icecream PDF Editor 2.43.Svc_6Ouq5.exe"C:\ProgramData\Icecream PDF Editor 2.43.Svc_6Ouq5.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\Icecream PDF Editor 2.43_a8A0p.exe"C:\ProgramData\Icecream PDF Editor 2.43_a8A0p.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UG4GL.tmp\Icecream PDF Editor 2.43_a8A0p.tmp"C:\Users\Admin\AppData\Local\Temp\is-UG4GL.tmp\Icecream PDF Editor 2.43_a8A0p.tmp" /SL5="$50212,22256985,64512,C:\ProgramData\Icecream PDF Editor 2.43_a8A0p.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.6MB
MD5b1d576461bf3752242ef21780204f7c9
SHA17e96f6e96d256290b35be93269f82494d51088d9
SHA2564caf64814daf1c68fc3c5150a9e502b457fd0141fcf192fdac024157b443a0db
SHA512911daad8590f2e34ce91ef48a858270b0caf6421df2f7ea6ce75b4e204515834d33494f5ff0abee86b06c711fe9f51f4515ef0c93c2043745974fe93bc457fad
-
Filesize
1.7MB
MD509968e60e27f6e90fd6657656dd238ed
SHA11846c404e2cc7dd4642b128ecd986ec549a90968
SHA256d042509be1a7519ed06950bd76b08656a39c0b8f21712056fc99f910775e74cc
SHA51230f5343d9296d4652e8cd05b9918b7b1d0b6a78593582736330f6f297ecc55cc7fcb35db31c7c17c5e03f648bc3a66c47d505bfbc08ae1e4a4db5fe2ff696860
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
911KB
MD5e1a29f2b2c7ed8a501e9d8dbfa1a3552
SHA105851cfcf872fe88af243ebd2f7adbc6c0c8c94d
SHA256ba2d79a2abc0f55fe131f0c708241c5822f2dbbbdc5bb72dac94a22bdc8e2160
SHA5123cf7bc57e3d8df28b5634c4b8e4562ba4206f0f0edb9e1efc19f2f1ac59b510389d90a9c660c5f761396d632639c72ceac81929651b999c71d0f49082bc9d35c
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
8KB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
92KB
-
Filesize
92KB