Malware Analysis Report

2024-09-09 16:53

Sample ID 240612-zpt1nstdpq
Target a251ab42e6336d564b858cdeefc2678b_JaffaCakes118
SHA256 fd12ad7d9ac7ea5d0719ee1e9c1693e8aa55777ab695e87e1286474bad5b476b
Tags
ramnit banker evasion spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fd12ad7d9ac7ea5d0719ee1e9c1693e8aa55777ab695e87e1286474bad5b476b

Threat Level: Known bad

The file a251ab42e6336d564b858cdeefc2678b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ramnit banker evasion spyware stealer trojan upx worm

Ramnit

Identifies VirtualBox via ACPI registry values (likely anti-VM)

UPX packed file

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-12 20:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 20:54

Reported

2024-06-12 20:56

Platform

win7-20240508-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe"

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA51A981-28FD-11EF-8D12-66A5A0AB388F} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424387540" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA518271-28FD-11EF-8D12-66A5A0AB388F} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe
PID 2792 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2792 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2792 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2792 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2792 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2792 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2792 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2792 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2356 wrote to memory of 2772 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2356 wrote to memory of 2772 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2356 wrote to memory of 2772 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2356 wrote to memory of 2772 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2372 wrote to memory of 2904 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2372 wrote to memory of 2904 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2372 wrote to memory of 2904 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2372 wrote to memory of 2904 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe

C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2

Network

Files

\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe

MD5 7dc51d67dba12402674baf7e67bfc89d
SHA1 94b2e12ec5f4258bf8727d53276331457a558edb
SHA256 ebaf815f84fd4fb931265e7c92119d2ad540620dfe9f8883a4f08b6796318f87
SHA512 5d76770e6fab626f6b7de2126ef8af39bb2e49162dc0c14d06a074653a68ecb6bc381d930ce974ebc2f8c4dfcfa7502f8699a426cd837230d497165ddbf6c901

memory/2792-8-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2792-9-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/836-10-0x0000000000400000-0x0000000000E9A000-memory.dmp

memory/2792-13-0x0000000000220000-0x0000000000221000-memory.dmp

memory/836-14-0x0000000000220000-0x0000000000282000-memory.dmp

memory/2792-12-0x0000000000400000-0x0000000000462000-memory.dmp

memory/836-11-0x0000000000220000-0x0000000000282000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EA51A981-28FD-11EF-8D12-66A5A0AB388F}.dat

MD5 364735d5ef7837292e4fe03255c53759
SHA1 31f2557d8fd5053513b9b4483bcccb129cad06f0
SHA256 a06e5ecea1362421876444d82fc9506c8a1c7f19f937ca65ff08f2944c252081
SHA512 0c7d7f27c9e0d119fe885ef8c326ad6a2c13c91196a5e39064fc7c4914df6d2a0eab9e726ab96f317bc1187a8483fbda4a5f0106734f55e1ac09c6892bed72f4

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EA518271-28FD-11EF-8D12-66A5A0AB388F}.dat

MD5 323e0f4aa557e1ed7749fb9b74c19306
SHA1 1d069b9efad8cd0dd5361686a91864b63be7e5d4
SHA256 ce549943395689af5ad7c0aab562f3aeb03c1f4a84ca6319604a8b232c0054f4
SHA512 c78d3bd1feacac931e17b496aaa58df6afed386ced52253e39933c985425e983ff731cd529fa2c0d20e71c509cbc42916a6a109fed54d31b6ff77f19d1689fbd

memory/836-15-0x0000000000400000-0x0000000000E9A000-memory.dmp

memory/2792-22-0x0000000000400000-0x0000000000462000-memory.dmp

memory/836-26-0x0000000000400000-0x0000000000E9A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 20:54

Reported

2024-06-12 20:56

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe

C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2872 -ip 2872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 264

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe

MD5 7dc51d67dba12402674baf7e67bfc89d
SHA1 94b2e12ec5f4258bf8727d53276331457a558edb
SHA256 ebaf815f84fd4fb931265e7c92119d2ad540620dfe9f8883a4f08b6796318f87
SHA512 5d76770e6fab626f6b7de2126ef8af39bb2e49162dc0c14d06a074653a68ecb6bc381d930ce974ebc2f8c4dfcfa7502f8699a426cd837230d497165ddbf6c901

memory/2872-4-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4660-3-0x0000000000400000-0x0000000000E9A000-memory.dmp

memory/2872-6-0x00000000005B0000-0x00000000005B1000-memory.dmp

memory/4660-7-0x0000000000400000-0x0000000000E9A000-memory.dmp

memory/2872-8-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4660-9-0x0000000000400000-0x0000000000E9A000-memory.dmp