Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:32

General

  • Target

    74340b87d35fbe9130472c449001e275_JaffaCakes118.exe

  • Size

    627KB

  • MD5

    74340b87d35fbe9130472c449001e275

  • SHA1

    7884614398d454f6b36ffdbe026840ada0e9cb90

  • SHA256

    136dea8a82b1f9d4d11bccb032485628e510952ebb4aa125747b168bfc1d5568

  • SHA512

    6db888503d1cc9ff32972dd37eb89e91eb5a587b7d2f43696f1b0e44f18d654d844e9b7dc7fbfb563630a8b046c175092e346500ed3051988888796ce308d119

  • SSDEEP

    12288:gxPf8ueqNUsveSRFoLisMwZbOZK58kdaEilkWzEQlyGqwm6e:wPf8ueJs26Dsh40BgEpGqwm6e

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74340b87d35fbe9130472c449001e275_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\74340b87d35fbe9130472c449001e275_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Users\Admin\AppData\Local\Temp\n9321\s9321.exe
      "C:\Users\Admin\AppData\Local\Temp\n9321\s9321.exe" 61f7fc21243fe9b59f1dd4f2E/wcuUrsP4qTd+988Xf5oak0bMKim6lUFOUaWxxFu4p8Uz/zEyawN9tfWz8Mcj7gehMVb3UJRBqyhjDHm4iVDK+NTqXfwd+Uy5GRykSty4sejO+4oUItwneyC2K18HDVsCOvhaCgLHp6AqluKVpg9tWhgbT8fNtSgcL6HMR6 /v "C:\Users\Admin\AppData\Local\Temp\74340b87d35fbe9130472c449001e275_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1600
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3308

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\n9321\s9321.exe

            Filesize

            350KB

            MD5

            39b961520af5ab4b1420140e76e0fd2f

            SHA1

            96c6c87fd9b46625e1f364d833a8231d463f0fd5

            SHA256

            0533cd8f934b9763d09a1e164ac02b67d6df34eb7584f783adaf7a777ce48cea

            SHA512

            69d86ce653e8f5ab7c9c45e9e05dd5a12b31d739fef0881e63c917fe0ccbe9177b59e92b33dd3774d53bdd1837abb571bea43fd1297ecf4359b607716454668a

          • memory/1600-12-0x00007FF97BA45000-0x00007FF97BA46000-memory.dmp

            Filesize

            4KB

          • memory/1600-13-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-27-0x000000001B600000-0x000000001B610000-memory.dmp

            Filesize

            64KB

          • memory/1600-30-0x000000001C4A0000-0x000000001C96E000-memory.dmp

            Filesize

            4.8MB

          • memory/1600-31-0x000000001C970000-0x000000001CA0C000-memory.dmp

            Filesize

            624KB

          • memory/1600-32-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-34-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-33-0x00007FF97BA45000-0x00007FF97BA46000-memory.dmp

            Filesize

            4KB

          • memory/1600-35-0x000000001CB40000-0x000000001CBA2000-memory.dmp

            Filesize

            392KB

          • memory/1600-36-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-37-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-38-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-39-0x000000001BCD0000-0x000000001BCD8000-memory.dmp

            Filesize

            32KB

          • memory/1600-40-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-41-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-42-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-43-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-44-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-45-0x00000000202C0000-0x00000000203FC000-memory.dmp

            Filesize

            1.2MB

          • memory/1600-46-0x0000000020910000-0x0000000020E1E000-memory.dmp

            Filesize

            5.1MB

          • memory/1600-47-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-48-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-49-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-50-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB

          • memory/1600-52-0x00007FF97B790000-0x00007FF97C131000-memory.dmp

            Filesize

            9.6MB