Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 01:16
General
- Target a3528c863eae765001ffaca41052d589_JaffaCakes118.exe
- Size 463KB
- Sample240613-bmrwjasdql
- SHA256 55ac0ad40cd8d7f3d7bbe57e58358531dba087a4b53fdaf0a4e1cd00025a4394
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3528c863eae765001ffaca41052d589_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3528c863eae765001ffaca41052d589_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wrgyfexvodhojl.exe"C:\Users\Admin\AppData\Local\Temp\wrgyfexvodhojl.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
parent.txt
wrgyfexvodhojl.exe
memory/1480-11-0x00007FFF7A130000-0x00007FFF7A3F9000-memory.dmp
memory/1480-10-0x000000001B640000-0x000000001B648000-memory.dmp
memory/1480-5-0x000000001B8F0000-0x000000001B934000-memory.dmp
memory/1480-6-0x000000001BE00000-0x000000001C2CE000-memory.dmp
memory/1480-7-0x000000001C370000-0x000000001C40C000-memory.dmp
memory/1480-3-0x00007FFF7A130000-0x00007FFF7A3F9000-memory.dmp
memory/1480-2-0x00007FFF7A130000-0x00007FFF7A3F9000-memory.dmp
memory/1480-4-0x0000000000EB0000-0x0000000000EB6000-memory.dmp
memory/1480-12-0x00007FFF7A130000-0x00007FFF7A3F9000-memory.dmp
memory/1480-13-0x00007FFF7A130000-0x00007FFF7A3F9000-memory.dmp
memory/1480-14-0x000000001FA60000-0x000000001FAC2000-memory.dmp
memory/1480-15-0x00007FFF7A130000-0x00007FFF7A3F9000-memory.dmp
memory/1480-26-0x0000000021FB0000-0x0000000022756000-memory.dmp
memory/1480-27-0x00007FFF7A130000-0x00007FFF7A3F9000-memory.dmp