16ca89afa6d3e34dae65173e8a13a33017e02b87b5ce685cf366154bb4962570

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe
Size

3.5MB
MD5

65d7413d90592d8c0ef9cab3f8b90399
SHA1

078d9b12e488fbad0fe69ec35920ad233759e4e8
SHA256

16ca89afa6d3e34dae65173e8a13a33017e02b87b5ce685cf366154bb4962570
SHA512

41f296bf3394cba872608d00270bb7caea31e3daf26f04cfd5395f2e0cf4b95eebc05683dec74c60c4c5a0f75b0f62eaabc4d55fed2b5b0719d9f0ded8007486
SSDEEP

98304:AefQ2pI93E8FgJzh395lVdt45iDwlqJDHkO:AeIGIBm19vV3D9JwO

Score

9^/10

evasion upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pU6iQmmeLz.tmp\htmlayout.dll	acprotect

Loads dropped DLL 1 IoCs

Processes:

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid process

5060 65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid	process
5060	65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pU6iQmmeLz.tmp\htmlayout.dll	upx
behavioral2/memory/5060-8-0x0000000010000000-0x0000000010269000-memory.dmp	upx
behavioral2/memory/5060-11-0x0000000010000000-0x0000000010269000-memory.dmp	upx
behavioral2/memory/5060-14-0x0000000010000000-0x0000000010269000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid process

5060 65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe
5060 65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

pid	process
5060	65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe
5060	65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65d7413d90592d8c0ef9cab3f8b90399_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pU6iQmmeLz.tmp\htmlayout.dll

Filesize
943KB

MD5
dd305582564b7973909265167faacce4

SHA1
02a8db6c70f328bbad69177d843553405f88fa0f

SHA256
58968138a0c8e6f7ab324a50906e29ef2980ccd5b844758fbf64176ea563a42c

SHA512
6cac3596c9d254c0d1f86be64affe801a7e887db8936c214431d0504ed19054ea94f747159e1c99e7bb60ad9ce88d1b48e5643fd92788585496eef785d6612cd

Download Submit
memory/5060-0-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/5060-1-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/5060-3-0x0000000000401000-0x00000000004C1000-memory.dmp

Filesize
768KB

Download
memory/5060-8-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download
memory/5060-10-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/5060-11-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download
memory/5060-12-0x0000000000400000-0x0000000000B2F000-memory.dmp

Filesize
7.2MB

Download
memory/5060-14-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download