629e9174a62848a84682452bb133f94e92b601ddd2479fde1644793d0b7a14f7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe
Size

14KB
MD5

27bd4829732fcf96c56fb2e913c21d2e
SHA1

186fd70b5a10b7fb8c59f588934cc7e5a05b9e7b
SHA256

629e9174a62848a84682452bb133f94e92b601ddd2479fde1644793d0b7a14f7
SHA512

baeaf0004c54b0873296ce2c8214d68ac1ab765aca56f1baad549f55a1ca13f08f13028bb1fa4060683cfc208a24d8f9172739b869c007df7960b6cf67de0d5c
SSDEEP

192:DHSy66VA3mUthq0aSElhot0Hb+m2NhUTy8NzOniG038tZJcdC7nu:DHSdSArHNanlhGE2UTZNCniG0sZN7n

Score

9^/10

evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2872	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27bd4829732fcf96c56fb2e913c21d2e_JaffaCakes118.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x0000000001310000-0x000000000131A000-memory.dmp

Filesize
40KB

Download