Analysis
- max time kernel
142s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 18:51
General
- Target a1d6470a5733f5f109fceb65b7ffb063_JaffaCakes118.exe
- Size 541KB
- Sample240612-xhl1dawbme
- SHA256 cdf6578401ee009c4281cd86c7f4a45ce85ebe836f49d1206d5e91a9465d854a
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1d6470a5733f5f109fceb65b7ffb063_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1d6470a5733f5f109fceb65b7ffb063_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Rundll32" dir=out action=allow protocol=any program="C:\Windows\system32\rundll32.exe"2⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\WindowsPowershell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true ; Set-MpPreference -MAPSReporting 0 ; Set-MpPreference -ExclusionProcess rundll32.exe ; Set-MpPreference -ExclusionExtension dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_mr4042sl.olr.ps1
memory/980-2-0x0000000000400000-0x000000000044A000-memory.dmp
memory/980-1-0x0000000000400000-0x000000000044A000-memory.dmp
memory/980-3-0x0000000000400000-0x000000000044A000-memory.dmp
memory/980-54-0x00000000020C0000-0x00000000020FF000-memory.dmp
memory/980-0-0x00000000020C0000-0x00000000020FF000-memory.dmp
memory/4556-26-0x0000000074470000-0x00000000744BC000-memory.dmp
memory/4556-37-0x0000000007440000-0x000000000745E000-memory.dmp
memory/4556-9-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/4556-10-0x00000000054D0000-0x00000000054F2000-memory.dmp
memory/4556-11-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/4556-12-0x0000000005E40000-0x0000000005EA6000-memory.dmp
memory/4556-7-0x0000000005540000-0x0000000005B68000-memory.dmp
memory/4556-22-0x0000000005EB0000-0x0000000006204000-memory.dmp
memory/4556-23-0x0000000006470000-0x000000000648E000-memory.dmp
memory/4556-24-0x00000000064C0000-0x000000000650C000-memory.dmp
memory/4556-5-0x0000000004EA0000-0x0000000004ED6000-memory.dmp
memory/4556-27-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/4556-25-0x0000000006A50000-0x0000000006A82000-memory.dmp
memory/4556-8-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/4556-39-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/4556-40-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/4556-38-0x0000000007470000-0x0000000007513000-memory.dmp
memory/4556-41-0x0000000007DE0000-0x000000000845A000-memory.dmp
memory/4556-42-0x00000000077A0000-0x00000000077BA000-memory.dmp
memory/4556-43-0x0000000007800000-0x000000000780A000-memory.dmp
memory/4556-44-0x0000000007A50000-0x0000000007AE6000-memory.dmp
memory/4556-45-0x00000000079C0000-0x00000000079D1000-memory.dmp
memory/4556-46-0x00000000079F0000-0x00000000079FE000-memory.dmp
memory/4556-47-0x0000000007A00000-0x0000000007A14000-memory.dmp
memory/4556-48-0x0000000007B10000-0x0000000007B2A000-memory.dmp
memory/4556-49-0x0000000007A40000-0x0000000007A48000-memory.dmp
memory/4556-52-0x00000000738A0000-0x0000000074050000-memory.dmp
memory/4556-4-0x00000000738AE000-0x00000000738AF000-memory.dmp