Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 20:04
Static task
static1
Behavioral task
behavioral1
Sample
a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe
-
Size
3.7MB
-
MD5
a21ec611f26a64591e145f37beeb0be4
-
SHA1
363aebfb872485864f16ad3680035f583e16bc31
-
SHA256
11947ea7c46e2a1084d7a7b1bad0acb181c631047398648f8d12e12589fb726b
-
SHA512
f584abf6941fdb8caf52efa2e43f9024db6c5ae30a10259470e6843a95fc65e18cbb7b3235ea6f2ce9c2a6e9a4f73fd558b79ef566c73b39d1c7eed400b60f20
-
SSDEEP
98304:mXFl9S5MBAq6w8qge/6KbZiYHRmFIDJAu:mf0g6PqD6gsxu
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00290000000143b9-13.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2980 a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe -
resource yara_rule behavioral1/files/0x00290000000143b9-13.dat upx behavioral1/memory/2980-17-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-19-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-21-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-22-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-23-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-24-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-25-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-26-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-27-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-28-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-29-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-30-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-31-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-32-0x0000000010000000-0x0000000010269000-memory.dmp upx behavioral1/memory/2980-33-0x0000000010000000-0x0000000010269000-memory.dmp upx -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir Desktop a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2980 a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a21ec611f26a64591e145f37beeb0be4_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
943KB
MD5dd305582564b7973909265167faacce4
SHA102a8db6c70f328bbad69177d843553405f88fa0f
SHA25658968138a0c8e6f7ab324a50906e29ef2980ccd5b844758fbf64176ea563a42c
SHA5126cac3596c9d254c0d1f86be64affe801a7e887db8936c214431d0504ed19054ea94f747159e1c99e7bb60ad9ce88d1b48e5643fd92788585496eef785d6612cd