04f19bef68507a0110fe5a8b5a3eaca92dc146c7181c2214169d2f2c2af030fe

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe
Size

485KB
MD5

008919e00d3b81b038b45b34fb8466b9
SHA1

2929fb3341260e12759fa284371e0c5ec5ff7833
SHA256

04f19bef68507a0110fe5a8b5a3eaca92dc146c7181c2214169d2f2c2af030fe
SHA512

d6fd4845edcde81dc1fcb265dbc362c08949a69c9ddc599b40320c4955358bb2eccaaa9e800fe630e54707a4c85b5114cb5fc52094068f36bb3519c9afe8ec9a
SSDEEP

12288:wgYeado/ui1uCC3rOP1VNIEX6s8ToSa3OhlJkATAc:w5XguChgeNrX6s8Tw3VBc

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x0000000000515000-memory.dmp	themida
behavioral1/memory/3024-9-0x0000000000400000-0x0000000000515000-memory.dmp	themida

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\win.com	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\win.com	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3024	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe
3024	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1160	3024	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1160	3024	008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1160
- C:\Users\Admin\AppData\Local\Temp\008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\008919e00d3b81b038b45b34fb8466b9_JaffaCakes118.exe"
  2⤵
  - Identifies Wine through registry keys
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-3-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/3024-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3024-7-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3024-9-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3024-6-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3024-5-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download