8e685899cc3110eefa8f04be21bd972f54ba4f8ad2335a28941fb6de5d18a598

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
Size

516KB
MD5

65bbee080bff97969a18c6ed050a6296
SHA1

085a255cbcb59b666ac2f1f44cff57643eb0d172
SHA256

8e685899cc3110eefa8f04be21bd972f54ba4f8ad2335a28941fb6de5d18a598
SHA512

1158ab26629bc0afc6c2ab005355ed2fb68450ad1dcf0a0eaa451161661de0d5c56ecb101eac45d63040d0c898f88a94286b896afba048732ac04355a779e7a1
SSDEEP

6144:/Kw9ZuL+7TBufhHztxTBIp2ZrPs+JiifYPeyy8JAt3kgURi34wgC1:/Kw9ZuL+7TQfhhcGTs+lYWyp+tcyNZ

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

s7689.exe

pid process

1840 s7689.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe

pid	process
1840	s7689.exe

Loads dropped DLL 4 IoCs

Processes:

65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe

pid	process
2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exes7689.exe

pid process

2128 65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
1840 s7689.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

s7689.exe

description pid process

Token: SeDebugPrivilege 1840 s7689.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

s7689.exe

pid process

1840 s7689.exe
1840 s7689.exe

description	pid	process
Token: SeDebugPrivilege	1840	s7689.exe

pid	process
1840	s7689.exe
1840	s7689.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe

description	pid	process	target process
PID 2128 wrote to memory of 1840	2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe	s7689.exe
PID 2128 wrote to memory of 1840	2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe	s7689.exe
PID 2128 wrote to memory of 1840	2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe	s7689.exe
PID 2128 wrote to memory of 1840	2128	65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe	s7689.exe

C:\Users\Admin\AppData\Local\Temp\65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128

C:\Users\Admin\AppData\Local\Temp\n7689\s7689.exe
"C:\Users\Admin\AppData\Local\Temp\n7689\s7689.exe" ins.exe /h 13a9a3.api.socdn.com /e 12912908 /u 76873fd7-d775-11e3-8a58-80c16e6f498c /t 54146c0e561ca3840c8b456e /v "C:\Users\Admin\AppData\Local\Temp\65bbee080bff97969a18c6ed050a6296_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\n7689\s7689.exe
Filesize
336KB

MD5
b135fc75caa27de9314e7d980c51acaf

SHA1
7454bd6f8485da5464bb9a101cdc8464acc00a86

SHA256
06fb2b270b815539fba6c6755b96c41f1ae2d1cf8705a42cdcd643eb68355eba

SHA512
c9e02e843d1e4bdeae948828c389e76f80efd3bc412b5e90e29f5ee2b12f600c44a32a2995b1f8b7a46c15d2828fab23155fd4152b896893d7f40756ce1366fd

Download Submit
memory/1840-17-0x000007FEF573E000-0x000007FEF573F000-memory.dmp

Filesize
4KB

Download
memory/1840-18-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/1840-34-0x0000000000940000-0x000000000094E000-memory.dmp

Filesize
56KB

Download
memory/1840-35-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download