1ca3019768703f044e3171e371df7efb5cd6546188e2963c1745c2697a0a6d4a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe
Size

1.7MB
MD5

fce733d0ea5ba8d159a6ead5c4452895
SHA1

c9065d3bd07e132e897366faf23bbd9ffc1e3f55
SHA256

1ca3019768703f044e3171e371df7efb5cd6546188e2963c1745c2697a0a6d4a
SHA512

2da52d71169ba0cf5b5676535dbb313341efd0c92a3679491586a68017e39f6936e341fa4821ccb23b14e0ca902a9c5b4c0a36fec03dd7eefa8b7e97b030ec66
SSDEEP

49152:KfiPVJx9NRmw0w4AnTqkj4Y2Y1jgL8HWP:KfiP1jRxP40Wks9ejgL8HI

Score

7^/10

evasion persistence themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Wine	fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3060-0-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-4-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-22-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-23-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-25-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-26-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-27-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-28-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-29-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-30-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-31-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-32-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-33-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-34-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-35-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-36-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-37-0x0000000000400000-0x00000000007B7000-memory.dmp	themida
behavioral1/memory/3060-38-0x0000000000400000-0x00000000007B7000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\start = "fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe"	fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\start = "fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe"	fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\	fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\	fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3060	fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fce733d0ea5ba8d159a6ead5c4452895_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3060-0-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-1-0x0000000002060000-0x00000000021A6000-memory.dmp

Filesize
1.3MB

Download
memory/3060-2-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3060-3-0x0000000004560000-0x0000000004562000-memory.dmp

Filesize
8KB

Download
memory/3060-4-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-12-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/3060-11-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/3060-10-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/3060-9-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/3060-8-0x0000000004510000-0x0000000004512000-memory.dmp

Filesize
8KB

Download
memory/3060-7-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/3060-13-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/3060-6-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/3060-5-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/3060-18-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/3060-17-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/3060-19-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/3060-16-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/3060-15-0x0000000004360000-0x0000000004362000-memory.dmp

Filesize
8KB

Download
memory/3060-14-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/3060-20-0x0000000004540000-0x0000000004541000-memory.dmp

Filesize
4KB

Download
memory/3060-21-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/3060-22-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-23-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-24-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3060-25-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-26-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-27-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-28-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-29-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-30-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-31-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-32-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-33-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-34-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-35-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-36-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-37-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3060-38-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download