Analysis
- max time kernel
141s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 12:44
General
- Target 91d414325ca3c1054d63f2779f46a4ea_JaffaCakes118.exe
- Size 524KB
- Sample240603-pystvseh2z
- SHA256 135f34240ab09f3aa9dae3011f91d337222b9a837ff4af49476bdc39f96ea34d
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91d414325ca3c1054d63f2779f46a4ea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91d414325ca3c1054d63f2779f46a4ea_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n5297\s5297.exe"C:\Users\Admin\AppData\Local\Temp\n5297\s5297.exe" ins.exe /u a1f15152-d775-11e3-8a58-80c16e6f498c /e 12912912 /h 24da85.api.socdn.com /v "C:\Users\Admin\AppData\Local\Temp\91d414325ca3c1054d63f2779f46a4ea_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 38602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2360 -ip 23601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s5297.exe
memory/1000-14-0x00007FFB43B55000-0x00007FFB43B56000-memory.dmp
memory/1000-15-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-16-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-17-0x000000001BE20000-0x000000001BE2E000-memory.dmp
memory/1000-20-0x000000001C590000-0x000000001CA5E000-memory.dmp
memory/1000-21-0x000000001CB00000-0x000000001CB9C000-memory.dmp
memory/1000-22-0x000000001CDD0000-0x000000001CE32000-memory.dmp
memory/1000-23-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-24-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-25-0x000000001CBD0000-0x000000001CBD8000-memory.dmp
memory/1000-26-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-27-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-28-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-29-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-30-0x000000001EB20000-0x000000001EC5C000-memory.dmp
memory/1000-31-0x0000000020C40000-0x000000002114E000-memory.dmp
memory/1000-32-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-33-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-34-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp
memory/1000-36-0x00007FFB438A0000-0x00007FFB44241000-memory.dmp