31d98ddf543783b9a789d204931d4c7fa516779cff6e7429a9ede27f198ae139

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0881d29c9d6715b21699cb530e64de66_JaffaCakes118.dll
Size

785KB
MD5

0881d29c9d6715b21699cb530e64de66
SHA1

9e82f1490e9667ce8b85e0d85d3bae4b45985efc
SHA256

31d98ddf543783b9a789d204931d4c7fa516779cff6e7429a9ede27f198ae139
SHA512

27d76a1babf909e0b35b36e2134c933b85bcf314bd174a4412c00d126e04d85af292d7801fd3f5346305c6d555d1adb1bb7cd97d162e75417b530828fdb9746a
SSDEEP

12288:WdGXmL8wb+vQzKklj0WmOmRDHg0mG/vxHvnZtGNNvpaBnREAvAQqbV9N6ydT:WdG2L8zuKYZmjd3PHyNvnQO

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Wine	regsvr32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1028	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1028	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1028	2488	regsvr32.exe	28
PID 2488 wrote to memory of 1028	2488	regsvr32.exe	28
PID 2488 wrote to memory of 1028	2488	regsvr32.exe	28
PID 2488 wrote to memory of 1028	2488	regsvr32.exe	28
PID 2488 wrote to memory of 1028	2488	regsvr32.exe	28
PID 2488 wrote to memory of 1028	2488	regsvr32.exe	28
PID 2488 wrote to memory of 1028	2488	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0881d29c9d6715b21699cb530e64de66_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0881d29c9d6715b21699cb530e64de66_JaffaCakes118.dll
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-0-0x0000000000A70000-0x0000000000C2C000-memory.dmp

Filesize
1.7MB

Download
memory/1028-1-0x0000000003900000-0x0000000003ABC000-memory.dmp

Filesize
1.7MB

Download
memory/1028-5-0x0000000000A70000-0x0000000000C2C000-memory.dmp

Filesize
1.7MB

Download
memory/1028-4-0x0000000000A71000-0x0000000000A84000-memory.dmp

Filesize
76KB

Download