Overview

overview

9

Static

static

1

69031d529f...18.exe

windows7-x64

9

69031d529f...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 23:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe

  • Size

    4.3MB

  • MD5

    69031d529f1888d1b8d8fbb058bcff46

  • SHA1

    07bd535a9a275b6baa2f0914b33173beb3f774b3

  • SHA256

    4475b338a1a204598c292abee455ac632d1250ed537a49f27833eb08a2160de3

  • SHA512

    461f3443a863ae0dd9590b058202bf1e66e50438b23669e9fb06b7826a731eaa701be42bd91bac2cc518760b412cb91237b6f82b64426225ba8c2c5e1820d7b3

  • SSDEEP

    98304:aqSh5zRZwYeMMIV3PsU6Z8y6TaOphYLYSHinQpUt/YV5DyzFf:ajHYOpCm/s9y

Score
9/10
bootkitdiscoveryevasionpersistencespywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:996
    • C:\ProgramData\Чистилка\Чистилка.exe
      C:\ProgramData\Чистилка\Чистилка.exe /srvcreate
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2608
    • C:\Users\Admin\AppData\Local\Temp\69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe" /test
      2⤵
      • Executes dropped EXE
      PID:2964
    • C:\Users\Admin\AppData\Local\Temp\69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe" /restart /util
      2⤵
      • Enumerates VirtualBox registry keys
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VirtualBox Guest Additions in registry
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      PID:2276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Чистилка\Чистилка Uninstall.lnk
    Filesize

    1KB

    MD5

    d34edc3ca386eab7c87a20a6686f494c

    SHA1

    f575b66afc96c770adb701224c3b525db280ea9a

    SHA256

    7444861c22407880fa7f19b7ee7d98e6da478d069053e3c1d1b151fac8cb28b8

    SHA512

    6d38fb9b8d684a4b902b4d689069f0b7a9407773200d226e6d9a48aa4695479f6641312815f2746c25eb72e1b50d08049c097ca65ed4bbfda3dfc1538e565258

    Download Submit

  • C:\ProgramData\Чистилка\config.dat
    Filesize

    476KB

    MD5

    6c72758ded357560dd86174db795a858

    SHA1

    917627cab7675e09dbe4503c718b2a0d524638a9

    SHA256

    517389e598d8b591012b21424fc82e768159e5933b7dce9b6a3ba1012251735a

    SHA512

    0f3e2cf9c0e2ea38d79d3216b3940f9479f641dfba591d4a7bef5a546ccd424521bc108c7e94abe86da9a517c6c5f24549d128dc2a7417dab5fd5919b1bcb902

    Download Submit

  • C:\ProgramData\Чистилка\settings.json
    Filesize

    638B

    MD5

    7b1f4611fde318efe702102a65a7cf37

    SHA1

    3b6b25f7858135a903f06e4236d4d288179c32b8

    SHA256

    0fee7a989e4db82caa219cc5663e97678e1162267a7a170002755390716068f2

    SHA512

    d4e66fe6fb5265452ec3f66e36461c1707808881a6371a9caf6a074f0a17f3af3e89bb66db2ebc16fa9361d569afef6d3cf9287914728a86e7bc8800fad9fbbc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cln4C0F.tmp
    Filesize

    49KB

    MD5

    abee4387ab69da821ed9397cc651597d

    SHA1

    5d14f4afdbe15448bf884b528ffffab874f920a7

    SHA256

    ac1dfd38d2fa61e28211e196cd3d754f6ccfb220e8c1beba52e54825cf615e22

    SHA512

    e014294cb60b66bd259f4a6ce262fc9eca30a30e7674dae178dbac6132ba464120e5d1076ee81c1210a2f42f819d94373733172cef9fda77c9effb4eed53a904

    Download Submit

  • C:\Users\Public\Desktop\Чистилка.lnk
    Filesize

    1KB

    MD5

    3947fd7c1f40dbffdc39b803b6fc39d8

    SHA1

    ce0c3241ec48a1ab4f7320d36961d88fd6606672

    SHA256

    ee64b75780141fdd1b2630580c41d5cca2fcd363a1b66131d18547b876e94652

    SHA512

    27e57ba7bd2fe03c42d037d4c5eb190a92a22b3ea866b17d6803b4e73f77eeb74573ce64b48a595d8d9448a7c9b8968e467cab9a0cf5d3c855c916fda138c3cb

    Download Submit

  • C:\Windows\Fonts\pns.ttf
    Filesize

    127KB

    MD5

    df8c626474a73ab7a8b511655597c7c4

    SHA1

    5de28f387ea88553d195d1978286d43c33231969

    SHA256

    723091ba5a1b8e65164075516d69c00c71225c6dde61ffc32dd4047803ab42b5

    SHA512

    c8f7d1577cb70610c40b96c835faca6b916c4924b5061351c8a67287567556b2014efb7c73cdcc4fb6533829541cd0264b8a9e428d3c572e29c06b0d96633d59

    Download Submit

  • \ProgramData\Чистилка\Чистилка.exe
    Filesize

    4.3MB

    MD5

    69031d529f1888d1b8d8fbb058bcff46

    SHA1

    07bd535a9a275b6baa2f0914b33173beb3f774b3

    SHA256

    4475b338a1a204598c292abee455ac632d1250ed537a49f27833eb08a2160de3

    SHA512

    461f3443a863ae0dd9590b058202bf1e66e50438b23669e9fb06b7826a731eaa701be42bd91bac2cc518760b412cb91237b6f82b64426225ba8c2c5e1820d7b3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\69031d529f1888d1b8d8fbb058bcff46_JaffaCakes118.exe
    Filesize

    5.9MB

    MD5

    d7ebb78bf1f0e4a8278b2d63013b1134

    SHA1

    498b315dcba9bf4403d6748be61453d5d8991b61

    SHA256

    c5a685088c44b1fbd01f49587af753b6a0f8f793de8d3b3d7e170574fef27ba8

    SHA512

    ead20a19b5262ce34f13bae9c9d1082ce5bf740759ea82042d83600094e38de7aea87d7533fdd7660369ec5bb8549e107aff562fa477711515eb9c15c9c93312

    Download Submit

  • memory/996-72-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/996-71-0x00000000008F0000-0x0000000000D4E000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/996-87-0x00000000008F0000-0x0000000000D4E000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/996-49-0x00000000008F0000-0x0000000000D4E000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/996-43-0x00000000008F0000-0x0000000000D4E000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/996-39-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

    Download