Analysis

  • max time kernel
    133s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 17:01

General

  • Target

    84d5bcf5145b4e674077d7a57ee278b6_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    84d5bcf5145b4e674077d7a57ee278b6

  • SHA1

    5246e20117951274aa94b4d5a9627b9d1fb4d720

  • SHA256

    3187ec733179fb0ea2221d39e3efb620c4fe9fa8b3790b0c91792dc073f4a08d

  • SHA512

    115da73519b9baf29ef5c3e05600377bcb770d34b47d27d4cd5dc0c5e202c4a149b0becaacceb95a93b4144fb168ec5a2671644ebbf8ec211d11f51fcbaa186c

  • SSDEEP

    49152:hV3ah3eaWTv/SM003FoiBALUHliSIKkYPg5YHGNN:hV3axTW7KM00FoiWUHgPbVLN

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84d5bcf5145b4e674077d7a57ee278b6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\84d5bcf5145b4e674077d7a57ee278b6_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1316-0-0x00000000008C0000-0x0000000000DDC000-memory.dmp

    Filesize

    5.1MB

  • memory/1316-5-0x00000000008C0000-0x0000000000DDC000-memory.dmp

    Filesize

    5.1MB