Analysis
- max time kernel
140s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
08/05/2024, 15:12
General
- Target 256ed9279e862367c01ffa17516be407_JaffaCakes118.exe
- Size 9.2MB
- Sample240508-slem9acg82
- SHA256 a6092efc5df98df216f74c336ca4bdfb209abb379a5b19ed1dd762e1ea84dc86
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 3 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\256ed9279e862367c01ffa17516be407_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\256ed9279e862367c01ffa17516be407_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
diagcode.dll
ftchipid.dll
sense4.dll
memory/4476-35-0x0000000007540000-0x0000000007548000-memory.dmp
memory/4476-37-0x0000000007590000-0x00000000075BA000-memory.dmp
memory/4476-7-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-8-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-6-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-9-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-1-0x00000000772A0000-0x00000000772A1000-memory.dmp
memory/4476-14-0x0000000000CE0000-0x0000000001DC8000-memory.dmp
memory/4476-15-0x0000000000CE0000-0x0000000001DC8000-memory.dmp
memory/4476-5-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-2-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-3-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-28-0x0000000004640000-0x000000000464C000-memory.dmp
memory/4476-29-0x0000000006AF0000-0x0000000006B18000-memory.dmp
memory/4476-30-0x0000000006B20000-0x0000000006B36000-memory.dmp
memory/4476-31-0x00000000070C0000-0x000000000740A000-memory.dmp
memory/4476-32-0x0000000006E60000-0x0000000006EA6000-memory.dmp
memory/4476-33-0x0000000007520000-0x0000000007528000-memory.dmp
memory/4476-34-0x00000000076F0000-0x00000000077AA000-memory.dmp
memory/4476-0-0x0000000000CE0000-0x0000000001DC8000-memory.dmp
memory/4476-4-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-38-0x00000000075C0000-0x00000000075C8000-memory.dmp
memory/4476-36-0x0000000007510000-0x0000000007526000-memory.dmp
memory/4476-39-0x00000000078B0000-0x0000000007926000-memory.dmp
memory/4476-40-0x0000000007950000-0x0000000007958000-memory.dmp
memory/4476-41-0x0000000007A80000-0x0000000007AA8000-memory.dmp
memory/4476-42-0x0000000007D00000-0x0000000007F4A000-memory.dmp
memory/4476-43-0x0000000007AC0000-0x0000000007ACA000-memory.dmp
memory/4476-49-0x000000000B690000-0x000000000B6C8000-memory.dmp
memory/4476-50-0x000000000B660000-0x000000000B66E000-memory.dmp
memory/4476-51-0x000000000ADF0000-0x000000000AE06000-memory.dmp
memory/4476-52-0x0000000000CE0000-0x0000000001DC8000-memory.dmp
memory/4476-53-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-54-0x000000000BD80000-0x000000000BDEC000-memory.dmp
memory/4476-55-0x000000000D7A0000-0x000000000D832000-memory.dmp
memory/4476-56-0x000000000DDF0000-0x000000000E394000-memory.dmp
memory/4476-62-0x000000000E830000-0x000000000E83A000-memory.dmp
memory/4476-64-0x00000000772A0000-0x00000000772A1000-memory.dmp
memory/4476-65-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-67-0x0000000077280000-0x0000000077370000-memory.dmp
memory/4476-69-0x0000000077280000-0x0000000077370000-memory.dmp