Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 17:48

General

  • Target

    bec10af9cf14c64c346e094782c62251_JaffaCakes118.exe

  • Size

    233KB

  • MD5

    bec10af9cf14c64c346e094782c62251

  • SHA1

    462bbbee006a3075306a99e01d650961d8f7ee09

  • SHA256

    81150558d7ec49f939fe7712adde551e902811835edf16fbdde9a4ad535c81b2

  • SHA512

    df8f1238367a715fb75e30e71da7b80e44b0e8fd27d321c6ea26b68287c3fad8c53d85b4c58590911bcf5ef031345202420d8a905c7b03d6d1c5d49e8314c052

  • SSDEEP

    6144:AajdMJb6SqIqOq2eJCdlCgyVQr1kXZonNtqq:92JbM2yYl9yqkXaNoq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.tmp
      C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.tmp
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bec10af9cf14c64c346e094782c62251_JaffaCakes118.tmp&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        3⤵
          PID:4308
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bec10af9cf14c64c346e094782c62251_JaffaCakes118.tmp&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
          3⤵
            PID:4396
        • C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.mm
          C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.mm /zhj
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3876
          • C:\Windows\GOG.exe
            C:\Windows\GOG.exe /zhj
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            PID:3916
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5652 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1
        1⤵
          PID:4572
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5752 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1
          1⤵
            PID:884
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4876 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:2356
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5428 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1
              1⤵
                PID:1368
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5444 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1
                1⤵
                  PID:208
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=3696 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1
                  1⤵
                    PID:4540
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5904 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1
                    1⤵
                      PID:4076
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5416 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
                      1⤵
                        PID:2352
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5412 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
                        1⤵
                          PID:3548

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.mm

                                Filesize

                                213KB

                                MD5

                                ea69828d8cca072d646f4a385dff148f

                                SHA1

                                bfa199be58f8b9e97661a6e7145e65b7be469716

                                SHA256

                                fec24c8906b484e09da7f704250a8b7a4ad60b42e0ce1fcfe115bd3a852b2346

                                SHA512

                                76f829790a986a7b8c2ad95a9480322220228509f770e8a620b9562b26a043e376f80df2b00581233fe11f78ce4a9d331ceb15342d162034bd46843e7f4533e6

                              • C:\Users\Admin\AppData\Local\Temp\bec10af9cf14c64c346e094782c62251_JaffaCakes118.tmp

                                Filesize

                                19KB

                                MD5

                                b5cffc5aa0a876d606e0bb8714bc32d4

                                SHA1

                                d14ea2881031ac3fffead469451a342108af86f0

                                SHA256

                                497f26fa64618bc336716fbf39378bcb63631c389276dd678b28e1e1359f3814

                                SHA512

                                a5d9143b14405ddcac1dc9d8a16e3aa3fa65fb57ba193c7a27f6b51bb77995e0ca8c8f6d7a66da43b426d5dbfbf96e0454448774ce33f4f7c1e39b325006d26b

                              • memory/1964-69-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/1964-22-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/1964-62-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3876-14-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-74-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-80-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-70-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-72-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-26-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-76-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-78-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-68-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-82-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-84-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-86-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-88-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-90-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB

                              • memory/3916-92-0x0000000000400000-0x00000000004393F3-memory.dmp

                                Filesize

                                228KB