Analysis

  • max time kernel
    136s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 03:11

General

  • Target

    1f40c4422ffff18c554b7313d3a8df60_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    1f40c4422ffff18c554b7313d3a8df60

  • SHA1

    ee5b7c88fea14731be96a3ccc05d4cd655f54ed1

  • SHA256

    30ef369d154a2d3bf33e28940ecfddf8a0194b4f4e7128571b643044556bbb70

  • SHA512

    d0229224f75e01cb8d4599d4a2961fce64188165aeaffc9206ad6f9e3e677e90424971b72f87ea052bdcfc9a9ee515bafea759396d5127d2615a5fa432b1b533

  • SSDEEP

    24576:KYiAos7FQQ03tyjhtueZwGnFCEBEc168tar8vG5Mq8WpdR0y06cQCEW:viAos7FQQRjrugjnF5tre5Mq8WpdRJ0H

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f40c4422ffff18c554b7313d3a8df60_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1f40c4422ffff18c554b7313d3a8df60_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe
      "C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe" SW_SHOWNORMAL
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2800
    • C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe
      "C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe" /ShowDeskTop
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:516
    • C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe
      "C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe" /autorun /setuprun
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1804
    • C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe
      "C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe" /setupsucc
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsd423B.tmp\FindProcDLL.dll

          Filesize

          3KB

          MD5

          8614c450637267afacad1645e23ba24a

          SHA1

          e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

          SHA256

          0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

          SHA512

          af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

        • C:\Users\Admin\AppData\Local\Temp\nsd423B.tmp\System.dll

          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

        • C:\Users\Admin\AppData\Roaming\yj_dtsk\Lander.ini

          Filesize

          422B

          MD5

          152d7eb5f41a46a5bd348a990987d932

          SHA1

          714d6a87a0abd8a455f5825f5a6029a8c4de4b4a

          SHA256

          4d7d96a4e7d18bd237b579f0a3e36e73cf2e2e0504497c8df8306a0903d115c5

          SHA512

          8b81a15c2bdd0ed537ae6e55d78206f8f7d2c8d0e0befbc3643c66c666e0220c610d13d47349efde563ecf4173626e0aa6104e4ff52166e027d7699e14fb8127

        • C:\Users\Admin\AppData\Roaming\yj_dtsk\Lander.ini

          Filesize

          454B

          MD5

          0abdd761eb06aa596b1809360d5292ec

          SHA1

          d1cc92ca8859d936dd3516200f355164d584436d

          SHA256

          7bcf17229b288193713ddb69c1c4e89246f1e4105fdab6d6ea0a1a668429d136

          SHA512

          a3e5b71a3c290658bf310ea07a1e262d575961b19f63b4a36baa45e43776382c3450e2360ade57d36adff1f35a7b5af0ed6f988259fa45ca2efcb1a5bbfced5e

        • C:\Users\Admin\AppData\Roaming\yj_dtsk\lander.ini

          Filesize

          391B

          MD5

          79833079e022c9ec09974a780083b68f

          SHA1

          a640dd52a3722a0e4be42c2789245d4a1d251d1c

          SHA256

          e415657883d27b1268f301948188906856a1998ef49b72f215cc474e331dbef3

          SHA512

          8494f2c99631c36e5d9f7e40423b9469e78198076eec6a443c219d30380e84fd298fb45ea03989c630a2297d7c4324c9a861695988740b18908720a8f0bd7bbf

        • C:\Users\Admin\AppData\Roaming\yj_dtsk\yj_dtsk.exe

          Filesize

          1.2MB

          MD5

          ebeb1bb919543b07d57aabb96c331e27

          SHA1

          06c1857f7cbb76ce01b6b1ea9a1bf8fc4538b2c9

          SHA256

          68538e5ab408445b3b73158a40ea6e9b1bada7e874a7c4b3bbf3b48568e9a676

          SHA512

          39d13db5ad0b17e16a9db56b3294cc7c0f66d79ab64d69d796dd005963f6f1a33000b1f306b7a59b2cd3525f9a41b7f192748837498123ad0ee54903c19817b2

        • memory/2800-53-0x0000000000920000-0x0000000000921000-memory.dmp

          Filesize

          4KB

        • memory/2800-63-0x0000000000920000-0x0000000000921000-memory.dmp

          Filesize

          4KB

        • memory/3420-14-0x0000000002130000-0x0000000002133000-memory.dmp

          Filesize

          12KB

        • memory/3420-15-0x0000000002131000-0x0000000002132000-memory.dmp

          Filesize

          4KB

        • memory/3420-62-0x0000000002131000-0x0000000002132000-memory.dmp

          Filesize

          4KB

        • memory/3420-70-0x0000000002130000-0x0000000002133000-memory.dmp

          Filesize

          12KB