1cc6193073a75d7ab69bc94ba2265ebaf3ee0e4780684acd242bb4eea298be6f

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe
Size

242KB
MD5

116ec1b12439d8bbd2a4220e8a0c034a
SHA1

b9acb1845b16752bfca051cd4f9ddb2487c7493d
SHA256

1cc6193073a75d7ab69bc94ba2265ebaf3ee0e4780684acd242bb4eea298be6f
SHA512

e33587be241640a30f0cb060a0d55bc140a63ce9d5eefb9c21dfc1f894ee73b4f727ba7d6d8bc2aac095ea6b8357c2118cd4a5bff1ba6d88c4fe94a53d95b6b0
SSDEEP

6144:39ka8sKwB/q/4JZmFUq59nT4drJrLOgRHLslh2PA73:3KsRFq/uZmCq59TkVrLRrsr2PA73

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1916	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1652	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	96
PID 5088 wrote to memory of 1652	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	96
PID 5088 wrote to memory of 1652	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	96
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 5088 wrote to memory of 1916	5088	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	97
PID 1916 wrote to memory of 3228	1916	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	98
PID 1916 wrote to memory of 3228	1916	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	98
PID 1916 wrote to memory of 3228	1916	116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\116ec1b12439d8bbd2a4220e8a0c034a_JaffaCakes118.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd6e88b753.bat"
    3⤵
    PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\upd6e88b753.bat

Filesize
277B

MD5
2ab0f7da93297074bd20d7180e27d6f0

SHA1
fc8e24180816a8ce08bc5de59b0710a017bb8538

SHA256
561aaab498fc25725d53aee5926f74d236e511bb6b491caaaaac7335ed245dad

SHA512
059df836b4678c1915faf955c003c5632e129271e0759d33e4248fb84c25b87ede1d390727320ecb63efc19abd851b082ea1cfd0cd02203872473c1c42af7a49

Download Submit
memory/1916-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1916-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1916-3-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1916-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads