16ca89afa6d3e34dae65173e8a13a33017e02b87b5ce685cf366154bb4962570

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe
Size

3.5MB
MD5

65d7413d90592d8c0ef9cab3f8b90399
SHA1

078d9b12e488fbad0fe69ec35920ad233759e4e8
SHA256

16ca89afa6d3e34dae65173e8a13a33017e02b87b5ce685cf366154bb4962570
SHA512

41f296bf3394cba872608d00270bb7caea31e3daf26f04cfd5395f2e0cf4b95eebc05683dec74c60c4c5a0f75b0f62eaabc4d55fed2b5b0719d9f0ded8007486
SSDEEP

98304:AefQ2pI93E8FgJzh395lVdt45iDwlqJDHkO:AeIGIBm19vV3D9JwO

Score

9^/10

evasion upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Xij06lYt50.tmp\htmlayout.dll	acprotect

Loads dropped DLL 1 IoCs

Processes:

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid process

1928 65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid	process
1928	65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Xij06lYt50.tmp\htmlayout.dll	upx
behavioral1/memory/1928-16-0x0000000010000000-0x0000000010269000-memory.dmp	upx
behavioral1/memory/1928-19-0x0000000010000000-0x0000000010269000-memory.dmp	upx
behavioral1/memory/1928-23-0x0000000010000000-0x0000000010269000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid process

1928 65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid	process
1928	65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1928

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Xij06lYt50.tmp\htmlayout.dll
Filesize
943KB

MD5
dd305582564b7973909265167faacce4

SHA1
02a8db6c70f328bbad69177d843553405f88fa0f

SHA256
58968138a0c8e6f7ab324a50906e29ef2980ccd5b844758fbf64176ea563a42c

SHA512
6cac3596c9d254c0d1f86be64affe801a7e887db8936c214431d0504ed19054ea94f747159e1c99e7bb60ad9ce88d1b48e5643fd92788585496eef785d6612cd

Download Submit
memory/1928-8-0x0000000075B70000-0x0000000075B71000-memory.dmp

Filesize
4KB

Download
memory/1928-4-0x0000000077160000-0x0000000077161000-memory.dmp

Filesize
4KB

Download
memory/1928-0-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/1928-2-0x0000000077160000-0x0000000077161000-memory.dmp

Filesize
4KB

Download
memory/1928-10-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/1928-1-0x0000000000401000-0x00000000004C1000-memory.dmp

Filesize
768KB

Download
memory/1928-16-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download
memory/1928-17-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/1928-18-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/1928-19-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download
memory/1928-20-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/1928-23-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download