Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 10:20

General

  • Target

    3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118.exe

  • Size

    501KB

  • MD5

    3f01cf63727ca8cbabc4a8f708ae1517

  • SHA1

    21b8fa0f3fa6817ad9e5c062cf8d56c3ebb5b545

  • SHA256

    b863ef1d634887948e32b76f80d62ba48d43275238fb41b74f4b0c493cf272c2

  • SHA512

    26afb4ad49dac5314bfec20711b7f4720d81d2e617d4f59d6939b6233375aff92e61b08360cbd2d08e04b07cdc908d57864992e449aff9620f80092fb54858a9

  • SSDEEP

    12288:30rHvfcA1OYg1x6YtCzDfXKoUXBipALLbsfuwh:30rHv0Yg/NGvmBNLah

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\n3082\s3082.exe
      "C:\Users\Admin\AppData\Local\Temp\n3082\s3082.exe" ins.exe /h ecee6.api.socdn.com /e 12909087 /t 53a01b12561ca /u c9b95e88-a5fe-11e3-8a58-80c16e6f498c /v "C:\Users\Admin\AppData\Local\Temp\3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2788

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Local\Temp\TarFF8B.tmp

          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • \Users\Admin\AppData\Local\Temp\n3082\s3082.exe

          Filesize

          286KB

          MD5

          c268c937148a046322219b77c5a031b0

          SHA1

          e83ed15c7ef694a2281955a16ffeec0672c56107

          SHA256

          c913057e15ac6b27b204be58b52132d62901746075faa298bb0d08c84958d51e

          SHA512

          44cc28c7a707a37e49afdd23af42a620a8eb78f7b54913b41d8cd5eadd5ea37a6eb16e83d99dd75bbc736e70970a7c94b33d55950ed3dda45302477ea3868a19

        • memory/2788-14-0x000007FEF5CEE000-0x000007FEF5CEF000-memory.dmp

          Filesize

          4KB

        • memory/2788-22-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

          Filesize

          9.6MB

        • memory/2788-75-0x00000000004B0000-0x00000000004BA000-memory.dmp

          Filesize

          40KB

        • memory/2788-76-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

          Filesize

          9.6MB