Analysis
- max time kernel
127s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
06/04/2024, 23:20
General
- Target e38762223f23dd3373ba4bff00f94c7a_JaffaCakes118.exe
- Size 515KB
- Sample240406-3bs31adh7x
- SHA256 4a6f525c5728145789924c96d5c8786dde14054a1d2a39db9c22fa8b30db0d6e
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 43 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e38762223f23dd3373ba4bff00f94c7a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e38762223f23dd3373ba4bff00f94c7a_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD7F1.tmp.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /f /sc MINUTE /mo 1 /tn "Microsoft Edge" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft Edge\Microsoft Edge.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:81⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\Microsoft Edge.exe"C:\Users\Admin\AppData\Roaming\Microsoft Edge\Microsoft Edge.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\Microsoft Edge.exe"C:\Users\Admin\AppData\Roaming\Microsoft Edge\Microsoft Edge.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmpD7F1.tmp.cmd
Microsoft Edge.exe
memory/1580-41-0x000000001B8F0000-0x000000001BA5A000-memory.dmp
memory/1580-36-0x00007FF9F4DE0000-0x00007FF9F58A1000-memory.dmp
memory/1580-37-0x00000000013E0000-0x00000000013F0000-memory.dmp
memory/1580-38-0x00000000013E0000-0x00000000013F0000-memory.dmp
memory/1580-39-0x00000000013E0000-0x00000000013F0000-memory.dmp
memory/1580-40-0x00000000013E0000-0x00000000013F0000-memory.dmp
memory/1580-42-0x00007FF9F4DE0000-0x00007FF9F58A1000-memory.dmp
memory/3360-4-0x0000000001210000-0x0000000001220000-memory.dmp
memory/3360-10-0x00007FF9F5070000-0x00007FF9F5B31000-memory.dmp
memory/3360-7-0x0000000001210000-0x0000000001220000-memory.dmp
memory/3360-0-0x0000000000AB0000-0x0000000000B36000-memory.dmp
memory/3360-2-0x0000000001210000-0x0000000001220000-memory.dmp
memory/3360-1-0x00007FF9F5070000-0x00007FF9F5B31000-memory.dmp
memory/3660-23-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-31-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-22-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-20-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-24-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-25-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-26-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-27-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-28-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-29-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-30-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-21-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-32-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-33-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-34-0x00007FF9F4D30000-0x00007FF9F57F1000-memory.dmp
memory/3660-19-0x00007FF9F4D30000-0x00007FF9F57F1000-memory.dmp
memory/3660-18-0x000000001B910000-0x000000001BA10000-memory.dmp
memory/3660-17-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-15-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-16-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-14-0x000000001B900000-0x000000001B910000-memory.dmp
memory/3660-13-0x00007FF9F4D30000-0x00007FF9F57F1000-memory.dmp