Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 05:53
Static task
static1
Behavioral task
behavioral1
Sample
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
06f6cc643322c6aeb67a9dd822af4ecb
-
SHA1
25d6a0750b0d8a008a1c5ec7945289df0e844e07
-
SHA256
581753565ad2d4426742ee961f3b4445c4bff72058e403688016cde173c98485
-
SHA512
e9588a7f0cf51bed0f7053b75186d6f207e67613747ecbc3902875da8cb6ec758147723f78a21a74c6900b707e51c5500b6b9c0276faa5a7d50334d63a222ae6
-
SSDEEP
49152:xapHO1k6mTR0ctbCk3Rxoheid6abpQ305Qvpo4ay/:xap2k6uKcFRxaeidFtQqQvpo4ay/
Malware Config
Extracted
cryptbot
bube01.info
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Wine 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exepid process 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exepid process 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exepid process 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe 1672 06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\06f6cc643322c6aeb67a9dd822af4ecb_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ntGNgMdT7\6Ng6fodTBU7ek.zipFilesize
262KB
MD5a1d9411fc45c7aed860ef5c37e2defab
SHA1a803b1af38fa614473514e8aef5e9f4039bcb577
SHA2568a68575d8f9feef682865d417cb89f6583cd7eeed1379bea3ee54ebee64ebf47
SHA51220aa97cd8e53d795ee97633783783b4d258ebf61daf5f50b12437bb531cf0b6c9183424827fae67a27d46106fa3b7b9671fb7c7f64ad4054eb589a1d07ab3e2f
-
C:\ProgramData\ntGNgMdT7\Files\_Info.txtFilesize
2KB
MD597cabecdfe473d01273072779089eaca
SHA179d2c71edb24471d8b498bf2c8083f222cb748c9
SHA2566e84b0a76f4a3a8045b33b165d03f609a86718e01389d15f7a5d82a2d20df8b6
SHA512a288503387cc6e6d3057d71acf994fc63ab5be2e917bbff431985065bf6790188e68e918d6bacc57632a4486fa5d39ec93e07d8bf8e756370bdd694a927025ee
-
C:\ProgramData\ntGNgMdT7\Files\_Info.txtFilesize
8KB
MD5e489aad8b48ed3640e22c05cbaa37e54
SHA19b9d476113b1c7ff621b5fa3bbf25b7144918165
SHA256cbfe5c4e859862e2b5f25b41722d302dd759ea6dd8e8289f13c8212f10d21d80
SHA512b1c7774c416b211509a13466427253710f277312812b66fe6dc1357fa9187a4c69b77f0eadb76b6d1b86842c656daeb46277d2f860e97de98f46002c6bb6311e
-
memory/1672-17-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/1672-18-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/1672-150-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-19-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/1672-151-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-0-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-16-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/1672-15-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/1672-22-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1672-23-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-2-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/1672-152-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-138-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-3-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/1672-13-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-4-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/1672-139-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/1672-155-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-1-0x0000000077E84000-0x0000000077E86000-memory.dmpFilesize
8KB
-
memory/1672-158-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-161-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-162-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-164-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-166-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-168-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-169-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-171-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-173-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB
-
memory/1672-175-0x0000000000940000-0x0000000000E75000-memory.dmpFilesize
5.2MB