Analysis
- max time kernel
149s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
05/04/2024, 07:07
General
- Target cd02d20b823fd3af525778af2150604c_JaffaCakes118.exe
- Size 349KB
- Sample240405-hx5npseb3s
- SHA256 48c5eca50c41f780c55b518e989c02c9dd62fd07761fefcb18909159491ad3fc
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 55 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd02d20b823fd3af525778af2150604c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd02d20b823fd3af525778af2150604c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cd02d20b823fd3af525778af2150604c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_t1qj4dno.sna.ps1
memory/404-48-0x0000000006D20000-0x0000000006DC3000-memory.dmp
memory/404-14-0x0000000002400000-0x0000000002436000-memory.dmp
memory/404-31-0x0000000005820000-0x0000000005B74000-memory.dmp
memory/404-61-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/404-58-0x0000000007360000-0x0000000007368000-memory.dmp
memory/404-57-0x0000000007380000-0x000000000739A000-memory.dmp
memory/404-56-0x0000000007280000-0x0000000007294000-memory.dmp
memory/404-55-0x0000000007270000-0x000000000727E000-memory.dmp
memory/404-54-0x0000000007240000-0x0000000007251000-memory.dmp
memory/404-53-0x00000000072C0000-0x0000000007356000-memory.dmp
memory/404-52-0x00000000070B0000-0x00000000070BA000-memory.dmp
memory/404-21-0x00000000056B0000-0x0000000005716000-memory.dmp
memory/404-51-0x0000000007040000-0x000000000705A000-memory.dmp
memory/404-46-0x00000000062D0000-0x00000000062EE000-memory.dmp
memory/404-15-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/404-16-0x0000000004FD0000-0x00000000055F8000-memory.dmp
memory/404-17-0x0000000004990000-0x00000000049A0000-memory.dmp
memory/404-18-0x0000000004990000-0x00000000049A0000-memory.dmp
memory/404-19-0x0000000004D40000-0x0000000004D62000-memory.dmp
memory/404-20-0x0000000004F60000-0x0000000004FC6000-memory.dmp
memory/404-50-0x0000000007680000-0x0000000007CFA000-memory.dmp
memory/404-49-0x0000000004990000-0x00000000049A0000-memory.dmp
memory/404-47-0x0000000004990000-0x00000000049A0000-memory.dmp
memory/404-32-0x0000000005D10000-0x0000000005D2E000-memory.dmp
memory/404-33-0x0000000005DC0000-0x0000000005E0C000-memory.dmp
memory/404-34-0x000000007F360000-0x000000007F370000-memory.dmp
memory/404-35-0x0000000006CE0000-0x0000000006D12000-memory.dmp
memory/404-36-0x000000006C9A0000-0x000000006C9EC000-memory.dmp
memory/4236-12-0x00000000089D0000-0x0000000008A6C000-memory.dmp
memory/4236-0-0x00000000004A0000-0x00000000004FE000-memory.dmp
memory/4236-3-0x0000000004EA0000-0x0000000004F32000-memory.dmp
memory/4236-1-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/4236-2-0x00000000053B0000-0x0000000005954000-memory.dmp
memory/4236-13-0x0000000008B10000-0x0000000008B62000-memory.dmp
memory/4236-11-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/4236-10-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/4236-9-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/4236-8-0x0000000074730000-0x0000000074EE0000-memory.dmp
memory/4236-7-0x0000000008420000-0x000000000842E000-memory.dmp
memory/4236-6-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/4236-5-0x0000000004F60000-0x0000000004F6A000-memory.dmp
memory/4236-4-0x0000000004FB0000-0x0000000004FC0000-memory.dmp