Overview

overview

10

Static

static

3

ecf7e1dba8...18.exe

windows7-x64

9

ecf7e1dba8...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-04-2024 08:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    ecf7e1dba888e815ec3b2a05dc2a4b13

  • SHA1

    cc68c2eed09f46ddf19e42ba4160dd14cf0c3949

  • SHA256

    6226b37a948914ea8bdfb9e8a1d35e26349ba1be6809ece009584a5627f52188

  • SHA512

    df839884a0ceda1feeeb1de6848a1eb620142e85c9804ce531ed156da530d8000fd9f5c481657aaceae334f85f1ecb3984574f644d52e7834d2065824e1dc48c

  • SSDEEP

    24576:FBJkmZYyxZvX9WFypOpcDnuWa9aktyqNQKe5GKrLr:amZYoZVIpckaktDQOK3

Score
9/10
evasion

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uhYLboPPS.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uhYLboPPS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE965.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uhYLboPPS.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:268
    • C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe"
      2⤵
        PID:672
      • C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe"
        2⤵
          PID:808
        • C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe"
          2⤵
            PID:2876
          • C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe"
            2⤵
              PID:1624
            • C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\ecf7e1dba888e815ec3b2a05dc2a4b13_JaffaCakes118.exe"
              2⤵
                PID:748

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpE965.tmp
              Filesize

              1KB

              MD5

              e28e9f3eb87b67a01f3734d910c5b089

              SHA1

              c4bd9e81de3f9478370b229a98ddc2f4114a9009

              SHA256

              d473256cc54bbb06d44b5ec471a10636eb5fca1a7595ab3d34e5731901864fdd

              SHA512

              dc1d9f17d522e90673b1adff90861775bd8500a936de0a7604d9fb00d055c934c8ba08e3b43717af737b0c2202e7dc77622eac445eb023a5d15e297ef58576e5

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
              Filesize

              7KB

              MD5

              d76ec570cfb1c7fdd8cf7ce751342b02

              SHA1

              b8cd9ba08143fd1312c8235199eae722c16cc5d5

              SHA256

              10d4483b8c844f3670a1601caa48539c5c45599b4b4e18de8eb8d0690df496eb

              SHA512

              79f6f357561d7e1534b2bc6d862c0801943e1995a820e4dd11f59323613da23fb9bedc91aade63e7ea0462a27e0076485472b65a4c894f16669988b1923895ef

              Download Submit

            • memory/268-34-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/268-42-0x0000000002790000-0x00000000027D0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/268-40-0x0000000002790000-0x00000000027D0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/268-41-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/268-37-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/268-39-0x0000000002790000-0x00000000027D0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/268-35-0x0000000002790000-0x00000000027D0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2472-38-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2472-16-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2472-21-0x00000000029A0000-0x00000000029E0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2472-22-0x00000000029A0000-0x00000000029E0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2472-15-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2620-24-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2620-36-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2620-26-0x000000006F600000-0x000000006FBAB000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2620-25-0x0000000002050000-0x0000000002090000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2620-23-0x0000000002050000-0x0000000002090000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2728-29-0x0000000074A30000-0x000000007511E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2728-7-0x0000000005740000-0x00000000057F2000-memory.dmp

              Filesize

              712KB

              Download

            • memory/2728-6-0x0000000005AF0000-0x0000000005BEE000-memory.dmp

              Filesize

              1016KB

              Download

            • memory/2728-5-0x0000000004F30000-0x0000000004F70000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2728-4-0x0000000074A30000-0x000000007511E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2728-0-0x0000000000300000-0x0000000000450000-memory.dmp

              Filesize

              1.3MB

              Download

            • memory/2728-3-0x0000000000250000-0x0000000000268000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2728-2-0x0000000004F30000-0x0000000004F70000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2728-1-0x0000000074A30000-0x000000007511E000-memory.dmp

              Filesize

              6.9MB

              Download