Analysis

  • max time kernel
    139s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:33

General

  • Target

    743499bd4b8be9b93c29322e2fd35027_JaffaCakes118.exe

  • Size

    683KB

  • MD5

    743499bd4b8be9b93c29322e2fd35027

  • SHA1

    c3b8397123f2c35d8079d52534d78d5e6b53d5a0

  • SHA256

    201faf48b05d9e5f08014ee2d4169f09ab4c2444fdc3e0db6759dd2be6cb8439

  • SHA512

    760a34d1f1e2d94eee4842e5a6c3757ccb37983344a3fd2eb66c2920b2728c22f6b94e3ab39a8034d87f669645a12f006cf2e2bbbd5ce1dd1bf10ddaf384ef06

  • SSDEEP

    12288:apI1ozCEXgFQZ5O4GsLUfia4eiTxMovq6WuPCOlf5+V6w:yI1oz7gFGL/Uqbe6x5Ku6Op5+V6w

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\743499bd4b8be9b93c29322e2fd35027_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\743499bd4b8be9b93c29322e2fd35027_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Users\Admin\AppData\Local\Temp\n9399\s9399.exe
      "C:\Users\Admin\AppData\Local\Temp\n9399\s9399.exe" 079b7835121229cbec4fa1fdB2E3W3z4CH0pdHLTWNU9tRDLJuiHkPQQ43/mJ1NrqAUYNu/M+HoLpbmSJRK/liDPuAVCz+i81b1WCHKeQ916UwGVpGslm/IYFo5OdSEfpaVGKOJvhLAqZtCco7vk8gdEeUCpM8s8O4KZ0LKBvTJAC7LxQbL0xt3hcTvvb1g= /v "C:\Users\Admin\AppData\Local\Temp\743499bd4b8be9b93c29322e2fd35027_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2348

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\n9399\s9399.exe

          Filesize

          350KB

          MD5

          d438749bcfe5bcdf1d59cbbb82341315

          SHA1

          2f4176c631e0190f35eb2963a4f8ad692fdcd6b7

          SHA256

          0aa566ada2feeb1714acd636da309edc6c3a9b0b8873d97942b55e053e55dd42

          SHA512

          f6ea2cf132c6564d685a6386705f2ff9b3912697f70d3e97e1754084c6c589141f3f72d6d82eeb6cc677a331325ab486389b1e3a202b7b21149499e8c020c67e

        • memory/2348-12-0x00007FF947845000-0x00007FF947846000-memory.dmp

          Filesize

          4KB

        • memory/2348-13-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-27-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

          Filesize

          64KB

        • memory/2348-30-0x000000001C380000-0x000000001C84E000-memory.dmp

          Filesize

          4.8MB

        • memory/2348-31-0x000000001C8F0000-0x000000001C98C000-memory.dmp

          Filesize

          624KB

        • memory/2348-32-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-33-0x000000001CAB0000-0x000000001CB12000-memory.dmp

          Filesize

          392KB

        • memory/2348-34-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-35-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-36-0x0000000000E70000-0x0000000000E78000-memory.dmp

          Filesize

          32KB

        • memory/2348-37-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-38-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-39-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-40-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-41-0x000000001E0D0000-0x000000001E20C000-memory.dmp

          Filesize

          1.2MB

        • memory/2348-42-0x0000000020800000-0x0000000020D0E000-memory.dmp

          Filesize

          5.1MB

        • memory/2348-43-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-44-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB

        • memory/2348-46-0x00007FF947590000-0x00007FF947F31000-memory.dmp

          Filesize

          9.6MB