Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
20/04/2024, 09:57
General
- Target fc7efb935097c16be35daa4ce86d4104_JaffaCakes118.exe
- Size 1.9MB
- Sample240420-lzag5aee6t
- SHA256 226f2e1d7e6239edc0da3eb0382db0cb4ce2bb4635d728f149623a1fdd73a425
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 4 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Drops file in Windows directory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc7efb935097c16be35daa4ce86d4104_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc7efb935097c16be35daa4ce86d4104_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
explorer.exe
spoolsv.exe
svchost.exe
memory/1072-122-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-120-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-75-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-68-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-106-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-108-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-110-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-42-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/1072-114-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-116-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-118-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-39-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/1072-23-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/1072-26-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-27-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/1072-41-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/1072-30-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/1072-35-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/1072-36-0x0000000004E60000-0x0000000004E62000-memory.dmp
memory/1072-33-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/1072-38-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/1072-37-0x0000000004F00000-0x0000000004F02000-memory.dmp
memory/1072-72-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/1072-124-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-112-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-126-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-132-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-130-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1072-128-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1616-14-0x0000000004ED0000-0x0000000004ED2000-memory.dmp
memory/1616-16-0x0000000004E30000-0x0000000004E32000-memory.dmp
memory/1616-2-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/1616-1-0x0000000076F04000-0x0000000076F06000-memory.dmp
memory/1616-8-0x0000000004870000-0x0000000004871000-memory.dmp
memory/1616-4-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1616-18-0x0000000004880000-0x0000000004881000-memory.dmp
memory/1616-46-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/1616-40-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1616-15-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/1616-17-0x00000000048B0000-0x00000000048B1000-memory.dmp
memory/1616-11-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/1616-9-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/1616-101-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1616-10-0x0000000004890000-0x0000000004891000-memory.dmp
memory/1616-0-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1616-7-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/1948-69-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/1948-131-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-71-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-78-0x0000000005220000-0x0000000005221000-memory.dmp
memory/1948-80-0x0000000005210000-0x0000000005211000-memory.dmp
memory/1948-81-0x0000000005240000-0x0000000005242000-memory.dmp
memory/1948-79-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/1948-82-0x00000000052F0000-0x00000000052F2000-memory.dmp
memory/1948-76-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/1948-84-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/1948-83-0x0000000005200000-0x0000000005201000-memory.dmp
memory/1948-85-0x00000000051E0000-0x00000000051E1000-memory.dmp
memory/1948-133-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-113-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-129-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-127-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-125-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-123-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-121-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-119-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-66-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-117-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-107-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-115-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-109-0x0000000000400000-0x0000000000873000-memory.dmp
memory/1948-74-0x0000000005230000-0x0000000005231000-memory.dmp
memory/1948-111-0x0000000000400000-0x0000000000873000-memory.dmp
memory/4040-64-0x0000000004EB0000-0x0000000004EB2000-memory.dmp
memory/4040-48-0x0000000000400000-0x0000000000873000-memory.dmp
memory/4040-63-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/4040-65-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/4040-60-0x0000000004E70000-0x0000000004E72000-memory.dmp
memory/4040-61-0x0000000004F00000-0x0000000004F02000-memory.dmp
memory/4040-59-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/4040-99-0x0000000000400000-0x0000000000873000-memory.dmp
memory/4040-52-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/4040-43-0x0000000000400000-0x0000000000873000-memory.dmp
memory/4040-56-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/4040-87-0x0000000000400000-0x0000000000873000-memory.dmp
memory/4040-55-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/4040-44-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/4040-53-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/4040-88-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/4040-62-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/4460-89-0x0000000074450000-0x00000000745AD000-memory.dmp
memory/4460-90-0x0000000000400000-0x0000000000873000-memory.dmp
memory/4460-94-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/4460-96-0x0000000000400000-0x0000000000873000-memory.dmp
memory/4460-86-0x0000000000400000-0x0000000000873000-memory.dmp