Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2025 04:51

General

  • Target

    JaffaCakes118_47c9d4bbb10a138cb8d126735b976f22.exe

  • Size

    2.3MB

  • MD5

    47c9d4bbb10a138cb8d126735b976f22

  • SHA1

    0ce89089004bb315f0f6934311d4a98678042e84

  • SHA256

    d3c967ebe05bcd11c84a933670ecdc748a621ab5b3892c45c883c0d55ba556f3

  • SHA512

    aef2f3af76887ebf736b21d43032e0edb59aaa40be608142abee9c165f2fb1ad47c66b8477f064293bd13080231a2309079a590d194fbac79a27994fff94b851

  • SSDEEP

    49152:8XJROhQi7Sn42IvWHSSwmBI7uAtN1po9xvCLJk03FczZ:850dW42ITWK7z/1C9L03F8

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47c9d4bbb10a138cb8d126735b976f22.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47c9d4bbb10a138cb8d126735b976f22.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:4592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4592-0-0x0000000000510000-0x0000000000B32000-memory.dmp

    Filesize

    6.1MB

  • memory/4592-1-0x0000000076240000-0x0000000076241000-memory.dmp

    Filesize

    4KB

  • memory/4592-2-0x0000000076220000-0x0000000076310000-memory.dmp

    Filesize

    960KB

  • memory/4592-5-0x0000000000510000-0x0000000000B32000-memory.dmp

    Filesize

    6.1MB

  • memory/4592-6-0x0000000000510000-0x0000000000B32000-memory.dmp

    Filesize

    6.1MB

  • memory/4592-7-0x0000000005B00000-0x00000000060A4000-memory.dmp

    Filesize

    5.6MB

  • memory/4592-8-0x00000000066D0000-0x0000000006CE8000-memory.dmp

    Filesize

    6.1MB

  • memory/4592-9-0x00000000056B0000-0x0000000005742000-memory.dmp

    Filesize

    584KB

  • memory/4592-10-0x0000000005880000-0x0000000005892000-memory.dmp

    Filesize

    72KB

  • memory/4592-11-0x0000000006440000-0x000000000654A000-memory.dmp

    Filesize

    1.0MB

  • memory/4592-12-0x0000000005AB0000-0x0000000005AEC000-memory.dmp

    Filesize

    240KB

  • memory/4592-13-0x00000000060B0000-0x00000000060FC000-memory.dmp

    Filesize

    304KB

  • memory/4592-14-0x0000000000510000-0x0000000000B32000-memory.dmp

    Filesize

    6.1MB

  • memory/4592-15-0x0000000076240000-0x0000000076241000-memory.dmp

    Filesize

    4KB

  • memory/4592-16-0x0000000076220000-0x0000000076310000-memory.dmp

    Filesize

    960KB

  • memory/4592-18-0x0000000076220000-0x0000000076310000-memory.dmp

    Filesize

    960KB