Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
3e4133340e0037854c020b73d139943a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3e4133340e0037854c020b73d139943a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
3e4133340e0037854c020b73d139943a_JaffaCakes118.exe
-
Size
511KB
-
MD5
3e4133340e0037854c020b73d139943a
-
SHA1
286cf9823e19c2a84d46d90c1fa18eabb69e19a3
-
SHA256
34ed19f34dbecbfa60533e3d0737d3d9862ae8d56084aabf536351c9242e8b67
-
SHA512
88d7cdaf21b768c728ae6b7c2ed4b959333be728b0d0da3c86889ea731075b92450ae0f594a4238be5597ef2798cab92c9c34ea86f1b3531fac9ffddbedf4395
-
SSDEEP
12288:Q1MbIpRtJTI6Kl8jBt1RMYn0IXQhQaCb/tDz1FcH6w:Q1MbuJTLjBt/fjkLCrd1iaw
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2940 s8876.exe -
Loads dropped DLL 4 IoCs
pid Process 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 2940 s8876.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2940 s8876.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2940 s8876.exe 2940 s8876.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2940 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 28 PID 2304 wrote to memory of 2940 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 28 PID 2304 wrote to memory of 2940 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 28 PID 2304 wrote to memory of 2940 2304 3e4133340e0037854c020b73d139943a_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e4133340e0037854c020b73d139943a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e4133340e0037854c020b73d139943a_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\n8876\s8876.exe"C:\Users\Admin\AppData\Local\Temp\n8876\s8876.exe" ins.exe /t 54146c05561ca39e0b8b4585 /u ad0d8641-dff0-11e3-8a58-80c16e6f498c /h eb4993.api.socdn.com /e 12932238 /v "C:\Users\Admin\AppData\Local\Temp\3e4133340e0037854c020b73d139943a_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD5292e5b0c53667812a05ff25415e0b91b
SHA135e0bd0943c7b449911592a0b6812642e3011c77
SHA2568ae142e7f6df8ee05c81d0317b284a747a19ae4e0a492208b04a3d25968ae574
SHA5121d984e94b25c4c51cff98a2e63795bce465e8ca526d9e391b09d12d148745b8011a22d21760bc12cf79f83adca34f22775d2e53e45311c25d4bd8d92bdfb2bd3