Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 06:54

General

  • Target

    3e3d2887da78290d5eac2b7323c60c04_JaffaCakes118.exe

  • Size

    683KB

  • MD5

    3e3d2887da78290d5eac2b7323c60c04

  • SHA1

    206e2cd04774f6da1787e24c678d456eacca8e9f

  • SHA256

    23489eca53712bea1f579854082f2123e18defda193c523933ef3a82903f71b8

  • SHA512

    d302d60685d52474b03853a21490b793ac6621b6891888ee855cdbb4b0dc2f40c71d419fd577987d45b5c6f6b02f56af3e041a5f9a69a65f4cfa630c10c6c044

  • SSDEEP

    12288:apI1ozCEXgFQZ5O4GsLUfia4eiTxMovq6WuPCOlf5+V6P:yI1oz7gFGL/Uqbe6x5Ku6Op5+V6P

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e3d2887da78290d5eac2b7323c60c04_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3e3d2887da78290d5eac2b7323c60c04_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\n8096\s8096.exe
      "C:\Users\Admin\AppData\Local\Temp\n8096\s8096.exe" d3665bc4f1e6580acf85fe50XytJtRhoF4/nTsRGzv6RHSQjc7zVDlLvJREs7QgISj+ilz8jP8Dx/XaGFvbUwQhZXMNbyPlplbKMSziS+zCO1PfvCa+fxjiyRCQsoHXKtYV2kUh2yr+/sOExTgdVMA5CBRdR4R+kAgSnRteqMycUQr8EVeNNbVUcUkh8dbfx /v "C:\Users\Admin\AppData\Local\Temp\3e3d2887da78290d5eac2b7323c60c04_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4368

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\n8096\s8096.exe

          Filesize

          350KB

          MD5

          d438749bcfe5bcdf1d59cbbb82341315

          SHA1

          2f4176c631e0190f35eb2963a4f8ad692fdcd6b7

          SHA256

          0aa566ada2feeb1714acd636da309edc6c3a9b0b8873d97942b55e053e55dd42

          SHA512

          f6ea2cf132c6564d685a6386705f2ff9b3912697f70d3e97e1754084c6c589141f3f72d6d82eeb6cc677a331325ab486389b1e3a202b7b21149499e8c020c67e

        • memory/4368-12-0x00007FFA4C775000-0x00007FFA4C776000-memory.dmp

          Filesize

          4KB

        • memory/4368-13-0x00007FFA4C4C0000-0x00007FFA4CE61000-memory.dmp

          Filesize

          9.6MB

        • memory/4368-27-0x000000001BEC0000-0x000000001BED0000-memory.dmp

          Filesize

          64KB

        • memory/4368-30-0x000000001C8F0000-0x000000001CDBE000-memory.dmp

          Filesize

          4.8MB

        • memory/4368-31-0x000000001CE60000-0x000000001CEFC000-memory.dmp

          Filesize

          624KB

        • memory/4368-32-0x00007FFA4C4C0000-0x00007FFA4CE61000-memory.dmp

          Filesize

          9.6MB

        • memory/4368-33-0x000000001D050000-0x000000001D0B2000-memory.dmp

          Filesize

          392KB

        • memory/4368-34-0x00007FFA4C4C0000-0x00007FFA4CE61000-memory.dmp

          Filesize

          9.6MB

        • memory/4368-35-0x00007FFA4C4C0000-0x00007FFA4CE61000-memory.dmp

          Filesize

          9.6MB

        • memory/4368-36-0x0000000021220000-0x000000002172E000-memory.dmp

          Filesize

          5.1MB

        • memory/4368-38-0x00007FFA4C4C0000-0x00007FFA4CE61000-memory.dmp

          Filesize

          9.6MB