Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
10/09/2024, 09:52 UTC
General
-
Target
d805a979941ea215ece5ca8bc764a402_JaffaCakes118.exe
-
Size
496KB
-
MD5
d805a979941ea215ece5ca8bc764a402
-
SHA1
afb533c55509bed84c66f5db86ce89fc6314db5b
-
SHA256
8a5bd38d99ca82232bf4bad6433a6f0358150dfd0c3a8b22c307e39499d4724d
-
SHA512
4ce9ef448e4c068b77120ca3de064d23813bb7138717b188aa724eebbca16458b365acecb68f342101943b71e5aacdf51ca9e48c46ed7b6849afc35ce7cf2192
-
SSDEEP
6144:JdY1D1JS816/Z75OKD4QYMZPlVRK72qOxIVcEGPdcdlbZN3da4Dtg9UqYEFLLb/z:J6jEV/OKVYatEjdHtSUqYOLb/z
Malware Config
Signatures
-
BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
-
Modifies firewall policy service 3 TTPs 4 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
-
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d805a979941ea215ece5ca8bc764a402_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d805a979941ea215ece5ca8bc764a402_JaffaCakes118.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks whether UAC is enabled
- Indicator Removal: Clear Persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
-
DNSmicrosoft.comRemote address:8.8.8.8:53Requestmicrosoft.comIN AResponsemicrosoft.comIN A20.76.201.171microsoft.comIN A20.70.246.20microsoft.comIN A20.112.250.133microsoft.comIN A20.236.44.162microsoft.comIN A20.231.239.246 -
DNSlago333.comRemote address:8.8.8.8:53Requestlago333.comIN AResponse
-
DNSlago333.clubRemote address:8.8.8.8:53Requestlago333.clubIN AResponse
-
DNSlago333.siteRemote address:8.8.8.8:53Requestlago333.siteIN AResponse
-
DNSlago333.siteRemote address:8.8.8.8:53Requestlago333.siteIN A
-
DNSlago333.xyzRemote address:8.8.8.8:53Requestlago333.xyzIN AResponse
-
20.76.201.171:80microsoft.com
-
8.8.8.8:53microsoft.comdns
DNS Request
microsoft.com
DNS Response
20.76.201.17120.70.246.2020.112.250.13320.236.44.16220.231.239.246
-
8.8.8.8:53lago333.comdns
DNS Request
lago333.com
-
8.8.8.8:53lago333.clubdns
DNS Request
lago333.club
-
8.8.8.8:53lago333.sitedns
DNS Request
lago333.site
DNS Request
lago333.site
-
8.8.8.8:53lago333.xyzdns
DNS Request
lago333.xyz
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1Clear Persistence
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
380KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
920KB
-
Filesize
1.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.7MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB