Analysis

  • max time kernel
    134s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 07:44

General

  • Target

    90fdb39e323f556e1cbd146aa6ac6058_JaffaCakes118.exe

  • Size

    692KB

  • MD5

    90fdb39e323f556e1cbd146aa6ac6058

  • SHA1

    6e83b951f55a0f8fa635252353f691b9482d773d

  • SHA256

    53792131a86763f55f1c114ec3b916639543eeca08823c66db3ab731f87acd6b

  • SHA512

    d923c0a73c2a19d62e996e7c0f1764e3d8c7626a9fe2d1c30b0837fae199621ddcd8e7ac5848e55d4715a4c723ae20875c08fa1cc82296e5b5d9d16971cb55d7

  • SSDEEP

    12288:uPAKP5yK40Z7uGpZjB7re144a/qlBooZSZYLN/6z:EAKP5jQqb4noCSeLN/6z

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90fdb39e323f556e1cbd146aa6ac6058_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\90fdb39e323f556e1cbd146aa6ac6058_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\n2049\s2049.exe
      "C:\Users\Admin\AppData\Local\Temp\n2049\s2049.exe" 516a44baba09890fe0694ef2RExE1XtpATrgYLhvMwD/7uWh/HNNZwNIoeq/fQnIIOnmHJ6agNu6EEzkizrPk2PzLIVHZ9ZkneimHCG1bXSZr6FnWWrhqtlgHMRcliB1VUPd7bxaIVfoMaUrUiyoFZRNINZyJ3bViUrJ2KqzRtwEOa7YZbvE1hVy2saF2jbX63s= /v "C:\Users\Admin\AppData\Local\Temp\90fdb39e323f556e1cbd146aa6ac6058_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:628
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
    1⤵
      PID:912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\n2049\s2049.exe

      Filesize

      350KB

      MD5

      3704d702fab17912fe846d0cbcc6e1ee

      SHA1

      80a8eb023387c1503296d2a69e6490745fee6c9a

      SHA256

      6d947c5db567f39d74552b385a91bf3e5b1766062240e0c50e296a1d561c5197

      SHA512

      bcaf82f3b28bbe23fcde975c9ad6bc5c3849f962410bf74e873544cb3600f6537db3772538a92a965023c1e8b43e57e4b7988090cbffc1932587d7de816162f4

    • memory/628-12-0x00007FFC06D15000-0x00007FFC06D16000-memory.dmp

      Filesize

      4KB

    • memory/628-13-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-29-0x000000001BC10000-0x000000001BC20000-memory.dmp

      Filesize

      64KB

    • memory/628-32-0x000000001C640000-0x000000001CB0E000-memory.dmp

      Filesize

      4.8MB

    • memory/628-33-0x000000001CBB0000-0x000000001CC4C000-memory.dmp

      Filesize

      624KB

    • memory/628-34-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-35-0x000000001CDA0000-0x000000001CE02000-memory.dmp

      Filesize

      392KB

    • memory/628-36-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-37-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-38-0x000000001CCB0000-0x000000001CCB8000-memory.dmp

      Filesize

      32KB

    • memory/628-39-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-40-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-41-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-42-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-43-0x0000000020360000-0x000000002049C000-memory.dmp

      Filesize

      1.2MB

    • memory/628-44-0x00000000209B0000-0x0000000020EBE000-memory.dmp

      Filesize

      5.1MB

    • memory/628-45-0x00007FFC06D15000-0x00007FFC06D16000-memory.dmp

      Filesize

      4KB

    • memory/628-46-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-47-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-48-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB

    • memory/628-50-0x00007FFC06A60000-0x00007FFC07401000-memory.dmp

      Filesize

      9.6MB