Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 10:39

General

  • Target

    3f1435bb14a1e5d3a6e3ace7614cb9c4_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    3f1435bb14a1e5d3a6e3ace7614cb9c4

  • SHA1

    6e1c888d3ba7b009070e685f1db0eaed45a2f835

  • SHA256

    21f3088efbd6ce88ba2574c0f925828aa7a3db6cab536f591784f289c71507b2

  • SHA512

    e59c18dccf479ea2f95b18d771d28e6c071b36fc511cde11bbd9278882a8eaef9d4c61095087e147600b1406437b5e1fa24331022cceb216869bca4833383e9a

  • SSDEEP

    12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4C:0+h9OY70z+warul3E4C

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f1435bb14a1e5d3a6e3ace7614cb9c4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3f1435bb14a1e5d3a6e3ace7614cb9c4_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Local\Temp\n6736\s6736.exe
      "C:\Users\Admin\AppData\Local\Temp\n6736\s6736.exe" 808567cf9a8de97c2b5a1640qG0TLKp6jzL7YIzSb8CyL37jfY2pespFSKK3cLPgLjlRnQc9HJn3qFqz/5TkUvKJEs5OTy0hPN1bPaqFJqTdTs0aTarunQlunTETTMIXlGaZAtWKHWiQOK2Z+mDQcT1YDvbR+L1HCPswi8H08jO9ODaQ /v "C:\Users\Admin\AppData\Local\Temp\3f1435bb14a1e5d3a6e3ace7614cb9c4_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3076

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\n6736\s6736.exe

          Filesize

          230KB

          MD5

          abaf13cb23de482dc944ab5b51ca3aac

          SHA1

          76837356db96dd56b647aba60f1adbbdc7b200fe

          SHA256

          b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

          SHA512

          cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

        • memory/3076-12-0x00007FF8013A5000-0x00007FF8013A6000-memory.dmp

          Filesize

          4KB

        • memory/3076-13-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

          Filesize

          9.6MB

        • memory/3076-27-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

          Filesize

          72KB

        • memory/3076-30-0x000000001C290000-0x000000001C75E000-memory.dmp

          Filesize

          4.8MB

        • memory/3076-31-0x000000001BC80000-0x000000001BD1C000-memory.dmp

          Filesize

          624KB

        • memory/3076-32-0x000000001C7E0000-0x000000001C842000-memory.dmp

          Filesize

          392KB

        • memory/3076-33-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

          Filesize

          9.6MB

        • memory/3076-34-0x0000000000E00000-0x0000000000E08000-memory.dmp

          Filesize

          32KB

        • memory/3076-35-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

          Filesize

          9.6MB

        • memory/3076-36-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

          Filesize

          9.6MB

        • memory/3076-37-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

          Filesize

          9.6MB

        • memory/3076-38-0x0000000020260000-0x000000002076E000-memory.dmp

          Filesize

          5.1MB

        • memory/3076-39-0x00000000209B0000-0x0000000020AEC000-memory.dmp

          Filesize

          1.2MB

        • memory/3076-41-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

          Filesize

          9.6MB