Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0224b573793d1780e3fec22739526c8f
-
SHA1
6ca9bc55382736c6fb173afb789318ee7067f206
-
SHA256
3b1824b41f3853376e21153d9125781dbb57b820d8a9a6cc037f82ea87f50973
-
SHA512
d4fe70783fd1666da5cb0220681b33aa7d99cd518c7944a043a43f82331497d6253bb7e3ac11b87eae780f06a49491a1197583dde5aee2606c8fc3b792300c93
-
SSDEEP
49152:qzRtq65qr5NfM7Tn3WflJPtMyMpy7fudoxTKd9W:qHqDLDflXPWGfSwiW
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe -
Modifies registry class 23 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\System.IsPinnedToNameSpaceTree = "0" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\System.PropList.DetailsPaneNullSelectTitle = "prop:" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\DefaultIcon 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\DefaultIcon\ = "%SystemRoot%\\SysWow64\\imageres.dll,-1023" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InProcServer32 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InProcServer32\ = "%SystemRoot%\\SysWow64\\windows.storage.dll" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell\restorelibraries\SeparatorAfter = "1" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell\restorelibraries\SeparatorBefore = "1" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\ShellFolder\FolderValueFlags = "270880" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell\restorelibraries\command 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048} 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\ = "UsersLibraries" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\System.PropList.DetailsPaneNullSelect = "prop:" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell\restorelibraries\Description = "@shell32.dll,-34646" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell\restorelibraries\command\DelegateExecute = "{c51b83e5-9edd-4250-b45a-da672ee3c70e}" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\ShellFolder\Attributes = "2961178893" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\LocalizedString = "@%SystemRoot%\\system32\\windows.storage.dll,-50691" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\SortOrderIndex = "84" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InProcServer32\ThreadingModel = "Both" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell\restorelibraries 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\shell\restorelibraries\MUIVerb = "@shell32.dll,-34645" 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\ShellFolder 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1524 0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0224b573793d1780e3fec22739526c8f_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524