Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
07-12-2024 15:19
General
-
Target
d320f6099d66a497692d20dd42e7ba40_JaffaCakes118.exe
-
Size
405KB
-
MD5
d320f6099d66a497692d20dd42e7ba40
-
SHA1
f55953666f0af20bfddfadc353dd8dabba0ec9b6
-
SHA256
9fa0012874369e53f8eaaf056ed607771a97199c7d69adef770845c20177920c
-
SHA512
c93f680a07f1aa695d98c5209d2f6cd4161c215e8fdc6e379b9c7d20933bcf39d12a7cd3432a86bf0abcc9ff1c5df4a2e4f17fa23b5f9d55fa205f0f9f4a7a3e
-
SSDEEP
6144:6aICHa+0ZjkVA9hSEcz/7tWYmZBBma05I5UzTjEw3yDP45B4ExKGO:bIC6+0hkm9AdEYmga0u5UzPRiD4NO
Malware Config
Signatures
-
BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
-
Betabot family
-
Modifies firewall policy service 3 TTPs 4 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
-
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d320f6099d66a497692d20dd42e7ba40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d320f6099d66a497692d20dd42e7ba40_JaffaCakes118.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks whether UAC is enabled
- Indicator Removal: Clear Persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1Clear Persistence
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
392KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
812KB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
812KB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
812KB
-
Filesize
1.7MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB