Analysis
- max time kernel
146s - max time network
148s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
09/04/2024, 10:57
General
- Target e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe
- Size 3.5MB
- Sample240409-m2k73sdc44
- SHA256 c3e1f7bd5dfa81bb5c55a12d804184f0ae5607bbe5a191ba4984c5cd36d89da2
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2736-0-0x0000000000DE0000-0x0000000001678000-memory.dmp
memory/2736-1-0x0000000077670000-0x00000000776B7000-memory.dmp
memory/2736-2-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-4-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-7-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-10-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-9-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-11-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-12-0x0000000077670000-0x00000000776B7000-memory.dmp
memory/2736-13-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-14-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-15-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-16-0x0000000000DE0000-0x0000000001678000-memory.dmp
memory/2736-17-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-18-0x0000000077670000-0x00000000776B7000-memory.dmp
memory/2736-19-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-20-0x0000000077670000-0x00000000776B7000-memory.dmp
memory/2736-21-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-22-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-23-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-24-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-25-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-26-0x0000000077C40000-0x0000000077C42000-memory.dmp
memory/2736-27-0x0000000074C50000-0x000000007533E000-memory.dmp
memory/2736-28-0x00000000052E0000-0x0000000005320000-memory.dmp
memory/2736-31-0x0000000000DE0000-0x0000000001678000-memory.dmp
memory/2736-32-0x0000000077670000-0x00000000776B7000-memory.dmp
memory/2736-33-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-34-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-35-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-36-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-37-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-38-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-39-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-40-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-41-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-42-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-43-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-44-0x0000000076410000-0x0000000076520000-memory.dmp
memory/2736-45-0x0000000074C50000-0x000000007533E000-memory.dmp
memory/2736-46-0x00000000052E0000-0x0000000005320000-memory.dmp