Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 06:55

General

  • Target

    c02fd4e18fbeaa9d0942ba18fa09209e_JaffaCakes118.exe

  • Size

    7.1MB

  • MD5

    c02fd4e18fbeaa9d0942ba18fa09209e

  • SHA1

    01fdd3e2d5768fa4ac771a29c803be1b146bd354

  • SHA256

    c861afa81a329ae8c41e634aeb95ca8f53def1ce18cef09e732cafa11d587598

  • SHA512

    e2e4d96a26ee87412437efa209fc91295b88dd1a0d7a197d4de9d5f9cb605415165cc1d939f4c406d78520e4e3ad13dbcad677b737b00d76403f89548cff259d

  • SSDEEP

    98304:M3HJ4oXiF6LTR7OHVTn70uzGk2XiKuIME8IvijpYdWo0F4zLwd0OglwUD4pO:M3HHiFwT2d1jKuIMmvij+dz0KyUsY

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c02fd4e18fbeaa9d0942ba18fa09209e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c02fd4e18fbeaa9d0942ba18fa09209e_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/308-0-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-1-0x0000000077080000-0x0000000077082000-memory.dmp

          Filesize

          8KB

        • memory/308-2-0x0000000000401000-0x0000000000426000-memory.dmp

          Filesize

          148KB

        • memory/308-3-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-4-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-5-0x0000000007EC0000-0x000000000831A000-memory.dmp

          Filesize

          4.4MB

        • memory/308-6-0x0000000007A60000-0x0000000007EB8000-memory.dmp

          Filesize

          4.3MB

        • memory/308-8-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-10-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-16-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-18-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-20-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-22-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-14-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-24-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-12-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-7-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-30-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-28-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-26-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-32-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-34-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-36-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-38-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-40-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-42-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-44-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-46-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-48-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-50-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-53-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-70-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-68-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-66-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-64-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-62-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-60-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-259-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-58-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-56-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-54-0x0000000007A60000-0x0000000007EB2000-memory.dmp

          Filesize

          4.3MB

        • memory/308-260-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-261-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-263-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-262-0x0000000000401000-0x0000000000426000-memory.dmp

          Filesize

          148KB

        • memory/308-265-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-267-0x0000000000400000-0x0000000000B19000-memory.dmp

          Filesize

          7.1MB

        • memory/308-268-0x0000000000401000-0x0000000000426000-memory.dmp

          Filesize

          148KB