Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 12:51

General

  • Target

    8433a8119675202daa8619b5b603152e_JaffaCakes118.exe

  • Size

    411KB

  • MD5

    8433a8119675202daa8619b5b603152e

  • SHA1

    74fbdb161082b20feb59bd20d524afce42ba7ee8

  • SHA256

    22fd608e56bd0533eb2e2cc7596a61be16af21e78521de64e6b1eb163ad79100

  • SHA512

    665aa9a123166cdd3096ae71ee7d7da2a2f12938042f72d527c5990233d2be168adcfcd41f0fcb3c1dcd06b0f534bed73be625f49bd7572e2b04ea9cf4b7b09e

  • SSDEEP

    12288:mANnXCSMhREvGllZwrqY4OMGWvzLv0v/EJDqt:mAlyfN6tMGWvzLesJut

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8433a8119675202daa8619b5b603152e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8433a8119675202daa8619b5b603152e_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Users\Admin\AppData\Local\Temp\n2125\s2125.exe
      "C:\Users\Admin\AppData\Local\Temp\n2125\s2125.exe" ins.exe /e 12932238 /u ad0d8641-dff0-11e3-8a58-80c16e6f498c /t 53b403e8561ca3b1398b4916 /h eb4993.api.socdn.com /v "C:\Users\Admin\AppData\Local\Temp\8433a8119675202daa8619b5b603152e_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4664
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 1960
      2⤵
      • Program crash
      PID:1444
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3656 -ip 3656
    1⤵
      PID:4920

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\n2125\s2125.exe

      Filesize

      288KB

      MD5

      13b3e3bb0757730a2442c8149381b458

      SHA1

      a2763fbed796d85942b68135a9da3879ab013782

      SHA256

      1c2576369f51175b1a71ac298e1caa0bd47adc30cb9aee10be9b3e464919ed6c

      SHA512

      32482cf75cbee6b366318896861839a20c854eeac41ce08fa0d1c0af765ff7596f52f7c164dd99c48bd899a7eeeae7119b92c62962a8a19022498fd8316af899

    • memory/3656-0-0x0000000000400000-0x000000000048A000-memory.dmp

      Filesize

      552KB

    • memory/3656-43-0x0000000000400000-0x000000000048A000-memory.dmp

      Filesize

      552KB

    • memory/4664-33-0x00007FFA34150000-0x00007FFA34AF1000-memory.dmp

      Filesize

      9.6MB

    • memory/4664-35-0x00007FFA34150000-0x00007FFA34AF1000-memory.dmp

      Filesize

      9.6MB

    • memory/4664-30-0x000000001C410000-0x000000001C8DE000-memory.dmp

      Filesize

      4.8MB

    • memory/4664-31-0x000000001C980000-0x000000001CA1C000-memory.dmp

      Filesize

      624KB

    • memory/4664-32-0x0000000001160000-0x0000000001168000-memory.dmp

      Filesize

      32KB

    • memory/4664-13-0x00007FFA34150000-0x00007FFA34AF1000-memory.dmp

      Filesize

      9.6MB

    • memory/4664-34-0x00007FFA34150000-0x00007FFA34AF1000-memory.dmp

      Filesize

      9.6MB

    • memory/4664-27-0x0000000001150000-0x000000000115A000-memory.dmp

      Filesize

      40KB

    • memory/4664-36-0x00007FFA34150000-0x00007FFA34AF1000-memory.dmp

      Filesize

      9.6MB

    • memory/4664-37-0x000000001FDF0000-0x000000001FE52000-memory.dmp

      Filesize

      392KB

    • memory/4664-38-0x00000000204C0000-0x00000000205FC000-memory.dmp

      Filesize

      1.2MB

    • memory/4664-39-0x0000000020B10000-0x000000002101E000-memory.dmp

      Filesize

      5.1MB

    • memory/4664-40-0x00007FFA34150000-0x00007FFA34AF1000-memory.dmp

      Filesize

      9.6MB

    • memory/4664-42-0x00007FFA34150000-0x00007FFA34AF1000-memory.dmp

      Filesize

      9.6MB

    • memory/4664-12-0x00007FFA34405000-0x00007FFA34406000-memory.dmp

      Filesize

      4KB