Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
13/07/2024, 02:43
General
- Target 3fe0166b697c2d685eee4b1034ac561d_JaffaCakes118.exe
- Size 6.7MB
- Sample240713-c7jw4ascll
- SHA256 15aa13a95776fb88f04428d9b4758e86095fa970923e6cc55012a8fda8f64067
Malware Config
Signatures
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fe0166b697c2d685eee4b1034ac561d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3fe0166b697c2d685eee4b1034ac561d_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/444-0-0x00000000008F0000-0x00000000019BC000-memory.dmp
memory/444-1-0x00007FFDC53D0000-0x00007FFDC55C5000-memory.dmp
memory/444-4-0x00000000008F0000-0x00000000019BC000-memory.dmp
memory/444-5-0x00000000008F0000-0x00000000019BC000-memory.dmp
memory/444-6-0x00000000062C0000-0x00000000068D8000-memory.dmp
memory/444-7-0x0000000005CE0000-0x0000000005CF2000-memory.dmp
memory/444-8-0x0000000005E10000-0x0000000005F1A000-memory.dmp
memory/444-9-0x0000000005D40000-0x0000000005D7C000-memory.dmp
memory/444-10-0x0000000005D80000-0x0000000005DCC000-memory.dmp
memory/444-12-0x00000000008F0000-0x00000000019BC000-memory.dmp