Analysis
- max time kernel
134s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
30/04/2024, 07:15
General
- Target 094f1a36cf540ff71b37e31602565b4b_JaffaCakes118.exe
- Size 655KB
- Sample240430-h29s8afb87
- SHA256 e8019df6572b12d099ac33d3c02e7cbd02971e55700430f5bbcd7855c4ff6ce0
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\094f1a36cf540ff71b37e31602565b4b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\094f1a36cf540ff71b37e31602565b4b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\openvpnserv.exe"C:\Users\Admin\AppData\Roaming\openvpnserv.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
openvpnserv.exe
memory/1844-12-0x0000000008F00000-0x0000000008F10000-memory.dmp
memory/1844-7-0x0000000006610000-0x0000000006611000-memory.dmp
memory/1844-3-0x0000000006610000-0x0000000006611000-memory.dmp
memory/1844-4-0x0000000006BE0000-0x0000000006C16000-memory.dmp
memory/1844-5-0x0000000074440000-0x0000000074BF0000-memory.dmp
memory/1844-8-0x0000000008F00000-0x0000000008F10000-memory.dmp
memory/1844-1-0x0000000006610000-0x0000000006611000-memory.dmp
memory/1844-6-0x0000000008F00000-0x0000000008F10000-memory.dmp
memory/1844-9-0x0000000006C40000-0x0000000006C46000-memory.dmp
memory/1844-10-0x0000000074440000-0x0000000074BF0000-memory.dmp
memory/1844-2-0x0000000006610000-0x0000000006611000-memory.dmp
memory/1844-11-0x0000000008F00000-0x0000000008F10000-memory.dmp
memory/1844-0-0x0000000004880000-0x00000000048B3000-memory.dmp
memory/1844-25-0x0000000004880000-0x00000000048B3000-memory.dmp
memory/1844-26-0x0000000074440000-0x0000000074BF0000-memory.dmp
memory/4612-27-0x0000000004D20000-0x0000000004D53000-memory.dmp
memory/4612-28-0x0000000006E40000-0x0000000006F40000-memory.dmp
memory/4612-29-0x0000000006E40000-0x0000000006E41000-memory.dmp
memory/4612-30-0x0000000006E40000-0x0000000006E41000-memory.dmp
memory/4612-31-0x0000000006E40000-0x0000000006E41000-memory.dmp
memory/4612-32-0x0000000006E40000-0x0000000006E41000-memory.dmp
memory/4612-33-0x0000000006E40000-0x0000000006F40000-memory.dmp
memory/4612-34-0x0000000006F40000-0x0000000006F41000-memory.dmp
memory/4612-35-0x0000000009330000-0x0000000009396000-memory.dmp