Analysis
- max time kernel
137s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
13/05/2024, 07:17
General
- Target 3e51d1cba7a1f620ad284080ef09402b_JaffaCakes118.exe
- Size 627KB
- Sample240513-h4fcdsca3t
- SHA256 158d3f1470e04628a72499e092dc937e60e070b37caff40f9f549039dd52c6db
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e51d1cba7a1f620ad284080ef09402b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e51d1cba7a1f620ad284080ef09402b_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n2628\s2628.exe"C:\Users\Admin\AppData\Local\Temp\n2628\s2628.exe" 2ec1bd190797b926d88733b06T0Lh1UAgNgTg1lGWoOOf/RJUQVU2jGEljkq7FR5g3FgwUICzw05LiAMERbP1XV8BVl6uudRCrIb2RCUTZxuP58zxchEcLICrwMrB30Ce7RpfyJYIj7ZvYFWSfcSvjDSJSQUrYSEZSUbM9l+d3r9lBKQcSk4H+W+i2muQScUthbr7sBBqzuKpxCUb7XVZOK93/NUBehtUQ== /v "C:\Users\Admin\AppData\Local\Temp\3e51d1cba7a1f620ad284080ef09402b_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s2628.exe
memory/3976-12-0x00007FF933985000-0x00007FF933986000-memory.dmp
memory/3976-13-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-29-0x000000001BFD0000-0x000000001BFE0000-memory.dmp
memory/3976-32-0x000000001CA10000-0x000000001CEDE000-memory.dmp
memory/3976-33-0x000000001CF80000-0x000000001D01C000-memory.dmp
memory/3976-34-0x000000001D0E0000-0x000000001D142000-memory.dmp
memory/3976-35-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-36-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-37-0x000000001C4A0000-0x000000001C4A8000-memory.dmp
memory/3976-38-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-39-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-40-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-41-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-42-0x0000000020B60000-0x0000000020C9C000-memory.dmp
memory/3976-43-0x00000000211B0000-0x00000000216BE000-memory.dmp
memory/3976-44-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-45-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-46-0x00007FF933985000-0x00007FF933986000-memory.dmp
memory/3976-47-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-48-0x00007FF9336D0000-0x00007FF934071000-memory.dmp
memory/3976-50-0x00007FF9336D0000-0x00007FF934071000-memory.dmp