Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/09/2024, 22:55 UTC
General
-
Target
fb0d706affbf6c35cbda9fa434878e97_JaffaCakes118.exe
-
Size
498KB
-
MD5
fb0d706affbf6c35cbda9fa434878e97
-
SHA1
d999ebab7899829b43172335a0cf41932e5f80fc
-
SHA256
40a17b2f80d0c6483797cd9c1b61370205c3dedf91d2f8f1d368218aa836e896
-
SHA512
7d1e3dbb47a720b39f950c4cc3e15d863fbc6acced2477da1ba87a7dcbb570ab0147030e652c4f84ce37574577f90257aeb412e0135e6029d09a1b7ba98c14cd
-
SSDEEP
12288:hKAIBUZJmywOb5esHnNXyNL4r4h/49siPFofw0m8vMZ:hKAVcsestiZm45SvyDra
Malware Config
Signatures
-
BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
-
Modifies firewall policy service 3 TTPs 4 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
-
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fb0d706affbf6c35cbda9fa434878e97_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb0d706affbf6c35cbda9fa434878e97_JaffaCakes118.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks whether UAC is enabled
- Indicator Removal: Clear Persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
-
DNSmicrosoft.comRemote address:8.8.8.8:53Requestmicrosoft.comIN AResponsemicrosoft.comIN A20.236.44.162microsoft.comIN A20.112.250.133microsoft.comIN A20.231.239.246microsoft.comIN A20.70.246.20microsoft.comIN A20.76.201.171 -
DNSlago333.comRemote address:8.8.8.8:53Requestlago333.comIN AResponse
-
DNSlago333.clubRemote address:8.8.8.8:53Requestlago333.clubIN AResponse
-
DNSlago333.siteRemote address:8.8.8.8:53Requestlago333.siteIN AResponse
-
DNSlago333.xyzRemote address:8.8.8.8:53Requestlago333.xyzIN AResponse
-
20.236.44.162:80microsoft.com
-
8.8.8.8:53microsoft.comdns
DNS Request
microsoft.com
DNS Response
20.236.44.16220.112.250.13320.231.239.24620.70.246.2020.76.201.171
-
8.8.8.8:53lago333.comdns
DNS Request
lago333.com
-
8.8.8.8:53lago333.clubdns
DNS Request
lago333.club
-
8.8.8.8:53lago333.sitedns
DNS Request
lago333.site
-
8.8.8.8:53lago333.xyzdns
DNS Request
lago333.xyz
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1Clear Persistence
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
384KB
-
Filesize
212KB
-
Filesize
644KB
-
Filesize
644KB
-
Filesize
408KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
920KB
-
Filesize
1.5MB
-
Filesize
920KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
920KB
-
Filesize
1.5MB
-
Filesize
52KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
920KB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
920KB
-
Filesize
1.7MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB