Analysis

  • max time kernel
    55s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 22:22

Errors

Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-20T22:23:27Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240226-en/instance_17-dirty.qcow2\"}"

General

  • Target

    fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe

  • Size

    83KB

  • MD5

    fdc85013066a66d2b09cb9b8e0b8e2aa

  • SHA1

    e7b3ae4cf2eabb3522b2bbf0ba0c7238ac671a0b

  • SHA256

    49785bd16ce8034cde002f71355446b51267696aeb9d422a6ed952ccf2c3605f

  • SHA512

    abbc6b1d637eb2e6cba5e128ecb96ef07f72f2538db74ee9044f1d58033d458b4f089b0b8b7aa2f49f8e1c1d4d1fee775d1bfafa0e72ff245b871d0b08b4ed2d

  • SSDEEP

    1536:GblagF9KIH+jege2ZEY7ayD32wM2Tl7nr5Ql9FOaB+hHU2GY:qTXKIdge2ZzjnVr66aAAY

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 269154324 /t REG_SZ /d "%userprofile%\269154324.exe" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 269154324 /t REG_SZ /d "C:\Users\Admin\269154324.exe" /f
        3⤵
        • Adds Run key to start application
        PID:3124
    • C:\Windows\SysWOW64\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /r /f /t 3
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1092
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FDC850~1.EXE > nul
      2⤵
        PID:3200
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa39fc055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3684

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2388-0-0x0000000000ED0000-0x0000000000EDE000-memory.dmp

      Filesize

      56KB

    • memory/2388-1-0x0000000000EE0000-0x0000000000EE7000-memory.dmp

      Filesize

      28KB

    • memory/2388-2-0x0000000000C90000-0x0000000000CB8000-memory.dmp

      Filesize

      160KB