Analysis
- max time kernel
138s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 08:50
General
- Target 912e3cd27c5464597d13a2b91dac9d03_JaffaCakes118.exe
- Size 664KB
- Sample240603-krqnpshe21
- SHA256 05f6aeb1c6647d4f64ecc28f42f8b1b11ff858fda8cc7f7dc62d25a344acb389
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\912e3cd27c5464597d13a2b91dac9d03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\912e3cd27c5464597d13a2b91dac9d03_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n2158\s2158.exe"C:\Users\Admin\AppData\Local\Temp\n2158\s2158.exe" 291a8302cbcefcab64a138efbaN/9c1lWNrTXJmrGSxxoPxeFi4tfaVDSpngWSJ1TPdTgHbvKCvRa85iVjOu4F+HV01Lm+xw5SZwk8phJYUbcRQgl9Q1aSu+GqHwA/6muvJDcwAKWIvcS4tlK8NvgBUv1rVXPaxs0ehgiyecrM/jMfjckZ6/Qius7y7fi/4= /v "C:\Users\Admin\AppData\Local\Temp\912e3cd27c5464597d13a2b91dac9d03_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s2158.exe
memory/1288-12-0x00007FFC0B1C5000-0x00007FFC0B1C6000-memory.dmp
memory/1288-13-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-29-0x000000001B830000-0x000000001B840000-memory.dmp
memory/1288-32-0x000000001C310000-0x000000001C7DE000-memory.dmp
memory/1288-33-0x000000001C7E0000-0x000000001C87C000-memory.dmp
memory/1288-34-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-35-0x000000001C9C0000-0x000000001CA22000-memory.dmp
memory/1288-36-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-37-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-38-0x000000001BD20000-0x000000001BD28000-memory.dmp
memory/1288-39-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-40-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-41-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-42-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-43-0x000000001E4D0000-0x000000001E60C000-memory.dmp
memory/1288-44-0x0000000020590000-0x0000000020A9E000-memory.dmp
memory/1288-45-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-46-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-47-0x00007FFC0B1C5000-0x00007FFC0B1C6000-memory.dmp
memory/1288-48-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-49-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp
memory/1288-51-0x00007FFC0AF10000-0x00007FFC0B8B1000-memory.dmp