Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
18/05/2024, 09:38
General
- Target 5419b68e892537e2f02ed14c671e315f_JaffaCakes118.exe
- Size 2.3MB
- Sample240518-ll768sdf38
- SHA256 d0a1612ed72fa557c8dc8094b7536bf1e58c4dca0b0ee2dccd21f884644388a6
Malware Config
Signatures
- Babylon RAT
Babylon RAT is remote access trojan written in C++.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5419b68e892537e2f02ed14c671e315f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5419b68e892537e2f02ed14c671e315f_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WindowsUpdate\svchost.exe"C:\ProgramData\WindowsUpdate\svchost.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WindowsUpdate\svchost.exe"C:\ProgramData\WindowsUpdate\svchost.exe" 36003⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
memory/3104-27-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3104-25-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3104-24-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3600-23-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3600-19-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3600-28-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3600-15-0x0000000003630000-0x0000000003631000-memory.dmp
memory/3600-21-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3600-14-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/3600-18-0x0000000000FF1000-0x0000000001056000-memory.dmp
memory/3600-17-0x0000000003640000-0x0000000003641000-memory.dmp
memory/3600-16-0x0000000003610000-0x0000000003611000-memory.dmp
memory/3600-20-0x0000000000FF0000-0x0000000001570000-memory.dmp
memory/4624-7-0x0000000000FA1000-0x0000000001006000-memory.dmp
memory/4624-0-0x0000000000FA0000-0x0000000001520000-memory.dmp
memory/4624-11-0x0000000000FA0000-0x0000000001520000-memory.dmp
memory/4624-5-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/4624-6-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/4624-4-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/4624-1-0x0000000077404000-0x0000000077406000-memory.dmp
memory/4624-10-0x0000000000FA0000-0x0000000001520000-memory.dmp