7183fb2afc304db26b762a3f0b8341e62641b199a476edc1b8dfed76eaaa24e9

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	lsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	lsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	lsm.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lsm.exe

Executes dropped EXE 3 IoCs

pid	Process
2212	lsm.exe
836	lsm.exe
2204	lsm.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine	lsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine	lsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine	lsm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	iplogger.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2360	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe
2212	lsm.exe
836	lsm.exe
2204	lsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2360	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe
2212	lsm.exe
836	lsm.exe
2204	lsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2884	2360	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe	28
PID 2360 wrote to memory of 2884	2360	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe	28
PID 2360 wrote to memory of 2884	2360	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe	28
PID 2360 wrote to memory of 2884	2360	bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe	28
PID 2952 wrote to memory of 2212	2952	taskeng.exe	32
PID 2952 wrote to memory of 2212	2952	taskeng.exe	32
PID 2952 wrote to memory of 2212	2952	taskeng.exe	32
PID 2952 wrote to memory of 2212	2952	taskeng.exe	32
PID 2952 wrote to memory of 836	2952	taskeng.exe	35
PID 2952 wrote to memory of 836	2952	taskeng.exe	35
PID 2952 wrote to memory of 836	2952	taskeng.exe	35
PID 2952 wrote to memory of 836	2952	taskeng.exe	35
PID 2952 wrote to memory of 2204	2952	taskeng.exe	36
PID 2952 wrote to memory of 2204	2952	taskeng.exe	36
PID 2952 wrote to memory of 2204	2952	taskeng.exe	36
PID 2952 wrote to memory of 2204	2952	taskeng.exe	36

C:\Users\Admin\AppData\Local\Temp\bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc5f98244b9660c80608b0d7446178af_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /f /tn "Microsoft LocalManager[Windows 7 Ultimate]" /tr "C:\ProgramData\{81987871-8198-8198-819878719743}\lsm.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2884

C:\Windows\system32\taskeng.exe
taskeng.exe {545BBF4D-698C-4C36-8A61-8B064344AA55} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\ProgramData\{81987871-8198-8198-819878719743}\lsm.exe
  C:\ProgramData\{81987871-8198-8198-819878719743}\lsm.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\ProgramData\{81987871-8198-8198-819878719743}\lsm.exe
  C:\ProgramData\{81987871-8198-8198-819878719743}\lsm.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\ProgramData\{81987871-8198-8198-819878719743}\lsm.exe
  C:\ProgramData\{81987871-8198-8198-819878719743}\lsm.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

2

Credential Access

Discovery

Query Registry

3

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

Lateral Movement

Collection

Command and Control

Web Service