68ba841edab6eb58dd49fac201d841df57ce0a272337fcf2aabfce6a989184d7

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe
Size

1.7MB
MD5

0fa95c8388a6cc9f044db6d0409beeb4
SHA1

b58f29968c227940eea9a227cad6a9ff45ab945f
SHA256

68ba841edab6eb58dd49fac201d841df57ce0a272337fcf2aabfce6a989184d7
SHA512

a7a44b66ead02169d22384c67a5eaa5f601b405b255e50969bcca860a3904c474e974e27d0ca0f821f742d955b0e79e2ac9c5e9ad08cc73a086ea8f653ef90fa
SSDEEP

24576:GKFub7qZ5AewMOJ8r75919XVeWzISY8A9lwHud/W0IzWgQAtN5PhpVRskKgMI2l+:TFubSqePOJ8r759/jId8AnCTvtskK/l+

Score

7^/10

evasion themida

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000400000-0x000000000075A000-memory.dmp	themida
behavioral1/memory/1976-5-0x0000000000400000-0x000000000075A000-memory.dmp	themida
behavioral1/memory/1976-9-0x0000000000400000-0x000000000075A000-memory.dmp	themida
behavioral1/memory/1976-20-0x0000000000400000-0x000000000075A000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe
1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe
1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1200	1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe	21
PID 1976 wrote to memory of 1200	1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe	21
PID 1976 wrote to memory of 1200	1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe	21
PID 1976 wrote to memory of 1200	1976	0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0fa95c8388a6cc9f044db6d0409beeb4_JaffaCakes118.exe"
  2⤵
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-6-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1200-10-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1976-0-0x0000000000400000-0x000000000075A000-memory.dmp

Filesize
3.4MB

Download
memory/1976-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1976-2-0x0000000000760000-0x00000000008AB000-memory.dmp

Filesize
1.3MB

Download
memory/1976-4-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/1976-5-0x0000000000400000-0x000000000075A000-memory.dmp

Filesize
3.4MB

Download
memory/1976-3-0x00000000043D0000-0x00000000043D2000-memory.dmp

Filesize
8KB

Download
memory/1976-9-0x0000000000400000-0x000000000075A000-memory.dmp

Filesize
3.4MB

Download
memory/1976-20-0x0000000000400000-0x000000000075A000-memory.dmp

Filesize
3.4MB

Download
memory/1976-21-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download