81dbbf64274c599feeef01b80d1d56d126cb607dfb54e8b65a5d7b35878b8842

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe
Size

453KB
MD5

8c3a1db3b96205665a9a1ec894058d81
SHA1

9fd6b8871b0a0b45e0352670098d7211fee63208
SHA256

81dbbf64274c599feeef01b80d1d56d126cb607dfb54e8b65a5d7b35878b8842
SHA512

62b20bbee62c56bf648a9be3c2e770bf8ddeab209f73a3d3b7f6bca99b0ffcf4c4042bf002c7dcaab79a0d4bfdcae54f3c7f341f1c5e639772ca9fbd6931390e
SSDEEP

12288:fp7kwCTvbdS3+Slzdwn0Q/7MR9tP5huP+dCzPpG:VkwgU3+SVdwS/5h1CzPpG

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4144	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe
4144	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1960	4144	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe	85
PID 4144 wrote to memory of 1960	4144	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe	85
PID 4144 wrote to memory of 1960	4144	8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c3a1db3b96205665a9a1ec894058d81_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd122d2c92.bat"
  2⤵
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\upd122d2c92.bat

Filesize
277B

MD5
3bcbfe859aefbdc1203828e9a3263239

SHA1
c5ff6e14702959778a314d17c01b337be98a71b1

SHA256
cd6bd9d136f246295fb05ce7531cd2274803e9bd29e5ac15e9540cb1d00b0e8a

SHA512
da4d27775e83bd8640d1864ad91899341e81fb3d39466d249c20ff6691a7651f073870800e7fe55ccf7c4ab2fd14f80d0fb8078dd9f32a49d6306f0509fefe8a

Download Submit
memory/4144-0-0x0000000002A30000-0x0000000002A91000-memory.dmp

Filesize
388KB

Download
memory/4144-1-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/4144-2-0x0000000002A30000-0x0000000002A91000-memory.dmp

Filesize
388KB

Download
memory/4144-5-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/4144-4-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/4144-3-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/4144-6-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/4144-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-9-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads