Overview

overview

10

Static

static

7

05ce277319...18.exe

windows7-x64

10

05ce277319...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2024 09:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05ce277319746f5e74fe432aa57606c6_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    05ce277319746f5e74fe432aa57606c6

  • SHA1

    4dd81c2f5cbb7e3d5bd75163505690393f408834

  • SHA256

    284bfc3d8f3e1527ff42558e208ea3289efc0d154bf8a38e6c040886ecb11941

  • SHA512

    218ee42251bb5120d28083d409e33efcfe2e0489876a9ff5100e8eddf272ec7b15591238e1290114b942d7c04be3029886a786e29edb18f7212e7ee8d300b1be

  • SSDEEP

    49152:ILQw+/FrExuIk9CZUz1VKncQpwUsqXpZZkjsb:7LtYxuIYCQvkXpDkjsb

Score
10/10
raccoonevasionstealerthemidatrojan

Malware Config

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 10 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05ce277319746f5e74fe432aa57606c6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\05ce277319746f5e74fe432aa57606c6_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1292-0-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-1-0x00000000772B4000-0x00000000772B6000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1292-3-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-4-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-5-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-6-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-8-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-7-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-2-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-9-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-10-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-12-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1292-14-0x00000000005D0000-0x0000000000AD6000-memory.dmp
    Filesize

    5.0MB

    Download