Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 10:57

General

  • Target

    e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe

  • Size

    3.5MB

  • MD5

    e9d5206109ad1c3a34b863fa42ee6e40

  • SHA1

    6543398463a12685648d4a5876965bee3af17b5c

  • SHA256

    c3e1f7bd5dfa81bb5c55a12d804184f0ae5607bbe5a191ba4984c5cd36d89da2

  • SHA512

    c4df9ec3d8b7b4b9fc3e8b29a0c49911b84faa5a805329e583d70099e1335a4337781d7278376d8db8f52eb31ec07b2e2db6bc9fc278075eb0c8c4bd239a0998

  • SSDEEP

    49152:LXenjmTRNtf1ihnlxlF2H6dfqS3q6o7h0D9kPV969oHZGrGeXa2cyM1bKzNqAfn3:LXs8tf0xlzJxo7hi9cbZPk4bKnP3

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:2736

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2736-0-0x0000000000DE0000-0x0000000001678000-memory.dmp

          Filesize

          8.6MB

        • memory/2736-1-0x0000000077670000-0x00000000776B7000-memory.dmp

          Filesize

          284KB

        • memory/2736-2-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-4-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-7-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-10-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-9-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-11-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-12-0x0000000077670000-0x00000000776B7000-memory.dmp

          Filesize

          284KB

        • memory/2736-13-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-14-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-15-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-16-0x0000000000DE0000-0x0000000001678000-memory.dmp

          Filesize

          8.6MB

        • memory/2736-17-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-18-0x0000000077670000-0x00000000776B7000-memory.dmp

          Filesize

          284KB

        • memory/2736-19-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-20-0x0000000077670000-0x00000000776B7000-memory.dmp

          Filesize

          284KB

        • memory/2736-21-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-22-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-23-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-24-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-25-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-26-0x0000000077C40000-0x0000000077C42000-memory.dmp

          Filesize

          8KB

        • memory/2736-27-0x0000000074C50000-0x000000007533E000-memory.dmp

          Filesize

          6.9MB

        • memory/2736-28-0x00000000052E0000-0x0000000005320000-memory.dmp

          Filesize

          256KB

        • memory/2736-31-0x0000000000DE0000-0x0000000001678000-memory.dmp

          Filesize

          8.6MB

        • memory/2736-32-0x0000000077670000-0x00000000776B7000-memory.dmp

          Filesize

          284KB

        • memory/2736-33-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-34-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-35-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-36-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-37-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-38-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-39-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-40-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-41-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-42-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-43-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-44-0x0000000076410000-0x0000000076520000-memory.dmp

          Filesize

          1.1MB

        • memory/2736-45-0x0000000074C50000-0x000000007533E000-memory.dmp

          Filesize

          6.9MB

        • memory/2736-46-0x00000000052E0000-0x0000000005320000-memory.dmp

          Filesize

          256KB