Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
03/06/2024, 10:51
General
- Target 9181d84a7d300febe16aea2404f8207c_JaffaCakes118.exe
- Size 74KB
- Sample240603-mxws1sdc27
- SHA256 6b65de5c2ad2b43519a6b780e5eface4b6acbf668303872286f078684c9f0ee3
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9181d84a7d300febe16aea2404f8207c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9181d84a7d300febe16aea2404f8207c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\sexsexy.avi"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
grdcfjag.exe
sexsexy.avi
memory/2432-17-0x00007FF7F1380000-0x00007FF7F1478000-memory.dmp
memory/2432-18-0x00007FF9AB9C0000-0x00007FF9AB9F4000-memory.dmp
memory/2432-22-0x00007FF9B0A40000-0x00007FF9B0A51000-memory.dmp
memory/2432-26-0x00007FF9ABA30000-0x00007FF9ABA41000-memory.dmp
memory/2432-27-0x00007FF99CD50000-0x00007FF99CF5B000-memory.dmp
memory/2432-25-0x00007FF9ABA50000-0x00007FF9ABA6D000-memory.dmp
memory/2432-29-0x00007FF9AB970000-0x00007FF9AB9B1000-memory.dmp
memory/2432-35-0x00007FF99AFD0000-0x00007FF99B005000-memory.dmp
memory/2432-28-0x00007FF99B5E0000-0x00007FF99C690000-memory.dmp
memory/2432-34-0x00007FF9AB7F0000-0x00007FF9AB801000-memory.dmp
memory/2432-33-0x00007FF9AB910000-0x00007FF9AB921000-memory.dmp
memory/2432-32-0x00007FF9AB930000-0x00007FF9AB941000-memory.dmp
memory/2432-31-0x00007FF9AB950000-0x00007FF9AB968000-memory.dmp
memory/2432-30-0x00007FF9ABA00000-0x00007FF9ABA21000-memory.dmp
memory/2432-24-0x00007FF9ABE10000-0x00007FF9ABE21000-memory.dmp
memory/2432-23-0x00007FF9B09B0000-0x00007FF9B09C7000-memory.dmp
memory/2432-21-0x00007FF9B1950000-0x00007FF9B1967000-memory.dmp
memory/2432-20-0x00007FF9B1BB0000-0x00007FF9B1BC8000-memory.dmp
memory/2432-19-0x00007FF99C880000-0x00007FF99CB36000-memory.dmp
memory/2432-66-0x00007FF99B5E0000-0x00007FF99C690000-memory.dmp