Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-09-2024 16:34
Static task
static1
Behavioral task
behavioral1
Sample
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe
-
Size
361KB
-
MD5
e2eb762d6d248fec5b8af8ab437cfdc2
-
SHA1
c6be1c85d65136e6ce2cc098db499837d2c5ea9e
-
SHA256
e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28
-
SHA512
0c85ede00a5ae7d0fe5aabfb9b662c6329922e6278bc80b59384234891a1383fe53d7931b9ca7d52ac95a355cd10840a4886a268238e347077d91fb0ba7d3a33
-
SSDEEP
6144:Co1FG6NxV4I+OAlUtWgH5MigzOjI5jqBtsimuD1X19XjK7kA:Co1kwxiI+OCUtW2MlOm3UD1XzKoA
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2664 cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exedescription pid process target process PID 1504 wrote to memory of 2664 1504 e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe cmd.exe PID 1504 wrote to memory of 2664 1504 e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe cmd.exe PID 1504 wrote to memory of 2664 1504 e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe cmd.exe PID 1504 wrote to memory of 2664 1504 e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2eb762d6d248fec5b8af8ab437cfdc2_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd136506f8.bat"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\upd136506f8.batFilesize
277B
MD5a9cdf5cbe7d4b1c2974ea481d5ac2e57
SHA1e6449c5b792c09812cd7d07e78335243a508bef2
SHA25668cba816a17af6f455b369da971866e43e0e695569c15731934da856459527ce
SHA512d05a9367257a35916a530b3143b93d96f252b8c46c8725e97611cff0f83af039a6fe01972b597a22bde5c0c391229fb9c9da356c68dd640ed14b8cef2ab22343
-
memory/1504-0-0x0000000002450000-0x00000000024D3000-memory.dmpFilesize
524KB
-
memory/1504-1-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/1504-2-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/1504-3-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/1504-4-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/1504-6-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/1504-5-0x0000000002450000-0x00000000024D3000-memory.dmpFilesize
524KB
-
memory/1504-7-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1504-11-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB