Analysis
- max time kernel
94s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/06/2024, 04:06
General
- Target 89515f74c1d8c23eb21ba68d9e4e819e_JaffaCakes118.exe
- Size 500KB
- Sample240601-ephx7aaa24
- SHA256 131ba2d94b368a5bcde967fd1188fa4b469dd0ffcde1e2bf94d8989e62c28a5f
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89515f74c1d8c23eb21ba68d9e4e819e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89515f74c1d8c23eb21ba68d9e4e819e_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n4913\s4913.exe"C:\Users\Admin\AppData\Local\Temp\n4913\s4913.exe" ins.exe /h f35b8.api.socdn.com /t 53a9c4b4561ca35c4f8b4cbf /u cf7d65aa-9fa4-11e3-8a58-80c16e6f498c /e 12909150 /v "C:\Users\Admin\AppData\Local\Temp\89515f74c1d8c23eb21ba68d9e4e819e_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 44442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4960 -ip 49601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s4913.exe
memory/1112-11-0x00007FFFFDC75000-0x00007FFFFDC76000-memory.dmp
memory/1112-12-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp
memory/1112-28-0x0000000000F00000-0x0000000000F0A000-memory.dmp
memory/1112-31-0x000000001C4D0000-0x000000001C99E000-memory.dmp
memory/1112-32-0x000000001C9A0000-0x000000001CA3C000-memory.dmp
memory/1112-33-0x0000000000F10000-0x0000000000F18000-memory.dmp
memory/1112-34-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp
memory/1112-35-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp
memory/1112-36-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp
memory/1112-37-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp
memory/1112-38-0x000000001DAD0000-0x000000001DB32000-memory.dmp
memory/1112-39-0x0000000020100000-0x000000002023C000-memory.dmp
memory/1112-40-0x0000000020750000-0x0000000020C5E000-memory.dmp
memory/1112-41-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp
memory/1112-42-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp
memory/1112-44-0x00007FFFFD9C0000-0x00007FFFFE361000-memory.dmp