Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-10-2024 01:33
General
-
Target
1edd2d8bc6c3f7788b80b83e6a58d5c1_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
1edd2d8bc6c3f7788b80b83e6a58d5c1
-
SHA1
9f08017abf2e95b36e5b194266a6edfa10d95472
-
SHA256
1c32ebcede2e7e29f1619b2d03315ea9dff73a29bb7ee4264348ac7763c4892c
-
SHA512
544d1f9f78e6e88733623d19129a183ec95d8f2992e50f7d39d01b74c9b4f7176bd058aeaf7a7ced1422a7d5be00b954bb09e88f52bd7eb5883c6ee9e22dba61
-
SSDEEP
49152:l6bRBnd1gAlhlopDii+wjzG9E4DVOfFo/kdFP9YzofnetUm7jO86:l6bRBnd1gAlhlqiinja9B02kXP9YsveX
Malware Config
Signatures
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Raccoon Stealer V1 payload 18 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1edd2d8bc6c3f7788b80b83e6a58d5c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1edd2d8bc6c3f7788b80b83e6a58d5c1_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
-
Filesize
8KB
-
Filesize
272KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB