Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-05-2024 12:57

General

  • Target

    54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe

  • Size

    240KB

  • MD5

    54d105a742ae07f7f55d30738a7b014f

  • SHA1

    a36767f17476133be1529e832b2be11a4cb8ee6c

  • SHA256

    c36a3c1d92892fb3fc4d8cba4e5f55fb4f027a0e61b351eee3c343a9cdbcd723

  • SHA512

    972fed4bece6945527a450f43a39f1ca2a339fdbe9782ddd73cef5c71b217d0a54fb90e0ef2b53f3ed4cc6262548e2da47cee781378e542dfe1f10453cc3214b

  • SSDEEP

    6144:Yn/L+VE11MHqeo1k5b2LDkTbuD4VDwjc3/r+:uaE1CF0moAnubjc3/r+

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Contacts a large (528) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\54d105a742ae07f7f55d30738a7b014f_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Windows\system32\wbem\WMIC.exe
          C:\Windows\system32\wbem\wmic.exe shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:720
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2344
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2436

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Windows Management Instrumentation

    1
    T1047

    Defense Evasion

    Indicator Removal

    1
    T1070

    File Deletion

    1
    T1070.004

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Network Service Discovery

    1
    T1046

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsqDFBD.tmp\System.dll
      Filesize

      11KB

      MD5

      a436db0c473a087eb61ff5c53c34ba27

      SHA1

      65ea67e424e75f5065132b539c8b2eda88aa0506

      SHA256

      75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

      SHA512

      908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    • C:\Users\Admin\AppData\Roaming\Crypto.dll
      Filesize

      11KB

      MD5

      d7abc2b77ed9178f00c2bef667a988da

      SHA1

      66f2f2ea1161f2f48b5df3a49fd3e43651642237

      SHA256

      8708aad9e59923e1b7830e763c5a42107449a378a6f355d46d58e8c85e44f8d2

      SHA512

      0dc6b4719ad872402573960f6be6e14f80cd5a000d240bd7a171d625833eac2c9c6d44e1c145d5d28b6dc4a4920174f2c19f76efa1f3d33ecca59994f6ec324f

    • memory/4764-24-0x00000000022A0000-0x00000000022AC000-memory.dmp
      Filesize

      48KB

    • memory/4856-23-0x0000000000400000-0x0000000000431000-memory.dmp
      Filesize

      196KB

    • memory/4856-26-0x0000000000400000-0x0000000000431000-memory.dmp
      Filesize

      196KB

    • memory/4856-29-0x0000000000400000-0x0000000000431000-memory.dmp
      Filesize

      196KB

    • memory/4856-34-0x0000000000400000-0x0000000000431000-memory.dmp
      Filesize

      196KB

    • memory/4856-35-0x0000000000400000-0x0000000000431000-memory.dmp
      Filesize

      196KB

    • memory/4856-36-0x0000000000400000-0x0000000000431000-memory.dmp
      Filesize

      196KB