e79e6a963a8a24b8b0583d705743877b389ef6a460fec86c4ad5edb99df1be85

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9119343541f019abda58b8cd8924211b_JaffaCakes118.dll
Size 1.9MB
Sample240603-j89bpsha2v
SHA256 e79e6a963a8a24b8b0583d705743877b389ef6a460fec86c4ad5edb99df1be85
MD5 9119343541f019abda58b8cd8924211b
SHA1 10d1721b9f19f78c242b08e285735f65b3f95b92
SHA512 d31a627396fc2df83525d269cd48c6eb4adbd59bafe01619927c8a2c1b3c5dda803b9cb4f0141365a70e3c2fb02057487750fd10b31ccd8a438ebbeb9a4453f7
SSDEEP 49152:r5BWhpdeXXyaYCfR8Vce56VegLU5MIXqocCYK:dBWhveHP3fSBYVfU5MIXttYK
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3056	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	3056	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3056	2192	rundll32.exe	29
PID 2192 wrote to memory of 3056	2192	rundll32.exe	29
PID 2192 wrote to memory of 3056	2192	rundll32.exe	29
PID 2192 wrote to memory of 3056	2192	rundll32.exe	29
PID 2192 wrote to memory of 3056	2192	rundll32.exe	29
PID 2192 wrote to memory of 3056	2192	rundll32.exe	29
PID 2192 wrote to memory of 3056	2192	rundll32.exe	29
PID 3056 wrote to memory of 2516	3056	rundll32.exe	30
PID 3056 wrote to memory of 2516	3056	rundll32.exe	30
PID 3056 wrote to memory of 2516	3056	rundll32.exe	30
PID 3056 wrote to memory of 2516	3056	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9119343541f019abda58b8cd8924211b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9119343541f019abda58b8cd8924211b_JaffaCakes118.dll,#1
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 300
    3⤵
    - Program crash
    PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-0-0x0000000074BA0000-0x00000000750C6000-memory.dmp

Download

memory/3056-1-0x0000000074670000-0x0000000074B96000-memory.dmp

Download

memory/3056-2-0x0000000074BA0000-0x00000000750C6000-memory.dmp

Download

memory/3056-3-0x0000000077A60000-0x0000000077A62000-memory.dmp

Download

memory/3056-6-0x0000000074671000-0x000000007467E000-memory.dmp

Download

memory/3056-5-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/3056-4-0x0000000000780000-0x0000000000782000-memory.dmp

Download

memory/3056-7-0x0000000074670000-0x0000000074B96000-memory.dmp

Download