Analysis
- max time kernel
92s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/06/2024, 03:09
General
- Target 8935728efc1f4271b55adbc397bfb339_JaffaCakes118.exe
- Size 697KB
- Sample240601-dnptnsge22
- SHA256 23308ce5469872bfd1ddd0bd02ac920c9f133e7abe40650a49cd441b62b7b1dd
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8935728efc1f4271b55adbc397bfb339_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8935728efc1f4271b55adbc397bfb339_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n3673\s3673.exe"C:\Users\Admin\AppData\Local\Temp\n3673\s3673.exe" 92c9b21ecbf54eb83845e926neRWDVCYgwrY85PLGpYycZSZBtfH13EZ/OnprDymEF+92sjU9BraQNKu6h+npyo6YUfU6H7QykmsBCeVLIok1CctC9UdWnIz4qUj+A4tmTjXxeiTZ3wULurtldg3NdPuHyzYog8WyCEUVFY2SEIbH00jCTdXuIzX2EwMXu0= /v "C:\Users\Admin\AppData\Local\Temp\8935728efc1f4271b55adbc397bfb339_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s3673.exe
memory/2084-12-0x00007FFD6F235000-0x00007FFD6F236000-memory.dmp
memory/2084-13-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-29-0x000000001C140000-0x000000001C150000-memory.dmp
memory/2084-32-0x000000001C770000-0x000000001CC3E000-memory.dmp
memory/2084-33-0x000000001CCE0000-0x000000001CD7C000-memory.dmp
memory/2084-34-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-35-0x000000001CED0000-0x000000001CF32000-memory.dmp
memory/2084-36-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-37-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-38-0x000000001C160000-0x000000001C168000-memory.dmp
memory/2084-39-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-40-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-41-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-42-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-43-0x000000001E8B0000-0x000000001E9EC000-memory.dmp
memory/2084-44-0x0000000020BB0000-0x00000000210BE000-memory.dmp
memory/2084-45-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-46-0x00007FFD6F235000-0x00007FFD6F236000-memory.dmp
memory/2084-47-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-48-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp
memory/2084-50-0x00007FFD6EF80000-0x00007FFD6F921000-memory.dmp