Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
12/05/2024, 04:32
General
- Target 38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe
- Size 131KB
- Sample240512-e6a9nsbh74
- SHA256 e85dd1e7ab0b26928c8f917ff0849e745d975c97a9391171ea7218983e441eb3
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET payload 1 IoCs
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 9 IoCs
- Adds Run key to start application 2 TTPs 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdates.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
38461cc4e383b3cfdefd41e987df1927_JaffaCakes118.exe.log
WindowsUpdates.exe.log
WindowsUpdates.exe
svchosts.exe
memory/3792-10-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/3792-4-0x000000001BD90000-0x000000001BE2C000-memory.dmp
memory/3792-6-0x000000001BEF0000-0x000000001BF3C000-memory.dmp
memory/3792-7-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/3792-8-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/3792-9-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/3792-0-0x00007FFD30C25000-0x00007FFD30C26000-memory.dmp
memory/3792-11-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/3792-12-0x000000001F580000-0x000000001F5E2000-memory.dmp
memory/3792-5-0x0000000000DD0000-0x0000000000DD8000-memory.dmp
memory/3792-1-0x000000001B1F0000-0x000000001B296000-memory.dmp
memory/3792-2-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/3792-3-0x000000001B810000-0x000000001BCDE000-memory.dmp
memory/3792-47-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/4488-45-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/4488-28-0x00007FFD30970000-0x00007FFD31311000-memory.dmp
memory/4488-27-0x00007FFD30970000-0x00007FFD31311000-memory.dmp