Analysis
-
max time kernel
12s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 04:06
Behavioral task
behavioral1
Sample
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
-
Size
12.6MB
-
MD5
f2a6e8143d7778697c0396b2ebbbc97f
-
SHA1
8e3f4db2c4e54ec274d0943af9c2d28e11256375
-
SHA256
7693091a21dc487f97f0ca1f51153e305587bf505460bbdee2fdee19e2584119
-
SHA512
04c411ebb219720462bbfe005f68fde1aa90e1c633bc4133298479053c28a5846068a38c611c9f94ecfeb4f0e8e81c65032afd373227e1aa69780258ff933849
-
SSDEEP
393216:fRtouHPatS+kxpNEMijBwGlUBfI+CYQxl9K3:fMuv9+k3JBI6Qxl9
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Driver.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Driver.exe -
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-1-0x0000000001360000-0x000000000265A000-memory.dmp loaderbot -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Driver.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Driver.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Driver.exe -
Drops startup file 1 IoCs
Processes:
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
Driver.exepid process 2576 Driver.exe -
Loads dropped DLL 1 IoCs
Processes:
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exepid process 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/1972-1-0x0000000001360000-0x000000000265A000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe" f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe -
Processes:
Driver.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Driver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exepid process 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exepid process 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exeDriver.exedescription pid process Token: SeDebugPrivilege 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe Token: SeLockMemoryPrivilege 2576 Driver.exe Token: SeLockMemoryPrivilege 2576 Driver.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exedescription pid process target process PID 1972 wrote to memory of 2576 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe Driver.exe PID 1972 wrote to memory of 2576 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe Driver.exe PID 1972 wrote to memory of 2576 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe Driver.exe PID 1972 wrote to memory of 2576 1972 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe Driver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48VqBvWwx4DFvegwZp7dE7WpBeYWhdaZUF8BiWc6HdwsP89dK2tiqnHSuyyBjeSn9cZ2ZCMrVrVDkAhGNvCC44DKL2zvQn1 -p x -k -v=0 --donate-level=1 -t 42⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Sysfiles\Driver.exeFilesize
6.2MB
MD569db4898504d484299184227fc5864e5
SHA12099fef060129cffc199a3fcf2668dd9e2da545a
SHA25683d13dc72e47b60a336d2f976234b5d0331bbd82d80c1b691ac7ea065b50cdb5
SHA5122abb486cb7abf897474be642cc460f9c4a84eb692b697ca473f326211f295471cd0bb9363094d3f6a179c2b28a068f01b85065530d96c11cc9c8a59c4cbb46d1
-
memory/1972-0-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1972-1-0x0000000001360000-0x000000000265A000-memory.dmpFilesize
19.0MB
-
memory/1972-3-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/1972-2-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/1972-4-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/1972-60-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/1972-58-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/1972-55-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/1972-51-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/2576-44-0x0000000000360000-0x0000000000380000-memory.dmpFilesize
128KB
-
memory/2576-16-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-28-0x00000000001B0000-0x00000000001BC000-memory.dmpFilesize
48KB
-
memory/2576-34-0x0000000180000000-0x000000018008D000-memory.dmpFilesize
564KB
-
memory/2576-40-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-41-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-42-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-43-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-17-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-45-0x000007FE80010000-0x000007FE80011000-memory.dmpFilesize
4KB
-
memory/2576-46-0x00000000024E0000-0x0000000002500000-memory.dmpFilesize
128KB
-
memory/2576-47-0x0000000002500000-0x0000000002520000-memory.dmpFilesize
128KB
-
memory/2576-48-0x0000000002520000-0x0000000002540000-memory.dmpFilesize
128KB
-
memory/2576-49-0x0000000002540000-0x0000000002560000-memory.dmpFilesize
128KB
-
memory/2576-50-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-20-0x0000000000340000-0x000000000035B000-memory.dmpFilesize
108KB
-
memory/2576-52-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-54-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-15-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-56-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-12-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/2576-59-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-11-0x000007FEFD9C0000-0x000007FEFDA2C000-memory.dmpFilesize
432KB
-
memory/2576-61-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-62-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-63-0x000007FEFD9C0000-0x000007FEFDA2C000-memory.dmpFilesize
432KB
-
memory/2576-65-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB
-
memory/2576-66-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/2576-67-0x000000013FEF0000-0x00000001412A0000-memory.dmpFilesize
19.7MB