Analysis
- max time kernel
94s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/06/2024, 07:13
General
- Target 89b600419c7580f50859af3518ffe447_JaffaCakes118.exe
- Size 688KB
- Sample240601-h1781aed44
- SHA256 13ded32642e1720232d577d0b00d64decd9ad3beeffad3ccf32d18d3780d6463
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89b600419c7580f50859af3518ffe447_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89b600419c7580f50859af3518ffe447_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n8681\s8681.exe"C:\Users\Admin\AppData\Local\Temp\n8681\s8681.exe" 0392bda3dc79283ae16fcb5c4G/QGM2JK5aBR1oyOJiQPUgPOIIeshTrTESVWL8gQncBnI6vUosaEnZXHeNtTdvmI26gNChd07++YjPXqUO3GpFbATb+gNr62ppeJoKTaQM+PnRYUMhzC18hKfJ6dNij2hE9S+2oMxs7tRg331sFSGIiRE6bTG2HnfQLnz+Rh/3emo5ln/Jy3F7KgOyv3L0M8gXzeTENma/gHss= /v "C:\Users\Admin\AppData\Local\Temp\89b600419c7580f50859af3518ffe447_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s8681.exe
memory/4424-12-0x00007FF8630A5000-0x00007FF8630A6000-memory.dmp
memory/4424-13-0x00007FF862DF0000-0x00007FF863791000-memory.dmp
memory/4424-29-0x000000001BDC0000-0x000000001BDD0000-memory.dmp
memory/4424-32-0x000000001C7F0000-0x000000001CCBE000-memory.dmp
memory/4424-33-0x000000001CD60000-0x000000001CDFC000-memory.dmp
memory/4424-34-0x00007FF862DF0000-0x00007FF863791000-memory.dmp
memory/4424-35-0x000000001CF50000-0x000000001CFB2000-memory.dmp
memory/4424-36-0x00007FF862DF0000-0x00007FF863791000-memory.dmp
memory/4424-37-0x00007FF862DF0000-0x00007FF863791000-memory.dmp
memory/4424-38-0x0000000021100000-0x000000002160E000-memory.dmp
memory/4424-40-0x00007FF862DF0000-0x00007FF863791000-memory.dmp